COPY --chown fixes the files being copied in, but WORKDIR had already created /app as root beforehand - the directory entry itself stayed root:root (no write bit for appuser), so celery beat's schedule-file write still failed with Permission denied even after the earlier --chown fix. Confirmed live on the actual deployment (local testing hadn't caught this). Co-Authored-By: Claude Sonnet 5 <[email protected]>