diff --git a/Dockerfile b/Dockerfile
index 1a7e5e8..42ad55a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -35,18 +35,19 @@ RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
 
 # ---------- 阶段 3：运行镜像 ----------
 FROM alpine:3.21
-RUN apk add --no-cache ca-certificates tzdata \
-    && addgroup -S openteam && adduser -S -G openteam openteam
+RUN apk add --no-cache ca-certificates tzdata su-exec
 WORKDIR /app
 COPY --from=go-builder /out/openteam ./openteam
 # 与二进制同目录放置，符合服务 CWD 约定（router 按相对路径 web/dist 找静态资源）
 COPY --from=web-builder /src/dist ./web/dist
-RUN mkdir -p /app/data && chown -R openteam:openteam /app
-USER openteam
+# 入口脚本以 root 启动，chown 数据目录后 su-exec 降权为 OT_UID:OT_GID（默认 1000:1000）
+COPY docker/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh && mkdir -p /app/data
 ENV OT_ENV=production \
     OT_PORT=8080 \
     OT_DB_DRIVER=sqlite \
     OT_DB_DSN=data/openteam.db
 EXPOSE 8080
 VOLUME ["/app/data"]
+ENTRYPOINT ["/entrypoint.sh"]
 CMD ["./openteam"]
diff --git a/docker-compose.yml b/docker-compose.yml
index fc44587..f588c04 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -17,8 +17,6 @@ services:
     restart: unless-stopped
     ports:
       - "${HOST_PORT:-8080}:8080"
-    # 以宿主用户运行，保证能写当前目录的 ./data 绑盘（默认 1000:1000，可用 OT_UID/OT_GID 覆盖）
-    user: "${OT_UID:-1000}:${OT_GID:-1000}"
     environment:
       OT_ENV: production
       OT_PORT: 8080
@@ -29,6 +27,9 @@ services:
       OT_MASTER_KEY: ${OT_MASTER_KEY:?请在 .env 中设置 OT_MASTER_KEY}
       OT_ADMIN_PASSWORD: ${OT_ADMIN_PASSWORD:?请在 .env 中设置 OT_ADMIN_PASSWORD}
       OT_JWT_SECRET: ${OT_JWT_SECRET:?请在 .env 中设置 OT_JWT_SECRET}
+      # 入口脚本据此 chown 数据目录并降权运行（默认 1000:1000）
+      OT_UID: "${OT_UID:-1000}"
+      OT_GID: "${OT_GID:-1000}"
     volumes:
       - ./data:/app/data
     healthcheck:
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
new file mode 100644
index 0000000..8f9e83d
--- /dev/null
+++ b/docker/entrypoint.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+# openteam 容器入口：以 root 短暂启动，修正数据目录属主后降权执行服务。
+# 解决绑定挂载/命名卷被 docker 以 root 自动创建、应用非 root 用户写不进 db 的问题。
+set -e
+
+PUID="${OT_UID:-1000}"
+PGID="${OT_GID:-1000}"
+
+mkdir -p /app/data
+chown -R "${PUID}:${PGID}" /app/data
+
+exec su-exec "${PUID}:${PGID}" "$@"