The bind-mounted SSH key is owned by host uid (1000/node) but the service runs as appuser (uid 1001). Use su-exec in entrypoint.sh to copy the key as root, fix ownership, then drop privileges. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>