The site worked in Docker — until WordPress tried to upload a file

Situation

With bind mounts, the web server inside the container and the user on the host can see the same files through different UID and GID contexts. Reads may work for a long time and hide that difference; the first write exposes it. The media-upload failure was therefore not a WordPress configuration problem but a filesystem-boundary problem.

Approach

I checked which user performed writes inside the container, which ownership appeared on mounted directories and exactly which path failed. I did not solve it by reflexively applying 777 permissions to the project. Instead, I adjusted ownership and permissions only on the upload path so WordPress could write while source code did not become unnecessarily world-writable.

Outcome

Uploads began working while development files retained sensible permissions. The fix became part of the startup process, so a fresh clone or rebuild no longer required a manual chmod ritual.