Rootless Docker maps container UID 0 back to the real host UID via
rootlesskit's primary user-namespace mapping, but any non-zero UID
passed via -u (including the host UID the wrapper always passes) is
instead routed through a separate subordinate-UID range
(/etc/subuid, typically 100000+) that owns nothing on the host
filesystem. Every bin/ai-memory subcommand that writes to a host
bind-mounted path (~/.claude/settings.json, ~/.claude.json, the hook
staging dir, $PWD/CLAUDE.md, skill directories) failed under
rootless Docker with Permission denied or a misleading "does not
exist" error.
Detect rootless Docker via `docker info --format
'{{.SecurityOptions}}'` and run as -u 0:0 only for the subcommands
that write host-side files (install-mcp, install-hooks, setup-agent,
install-instructions, install-skills). Thin-client commands (status,
bootstrap, search, ...) are untouched since they only touch the
/data named volume, which isn't host-visible.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
