fix(docker): handle bind-mounted log directory permissions

[cr7258]

Problem

Starting powermem-server with the Compose bind mount ./logs:/app/logs can leave the memory service unavailable:

Failed to initialize service singletons: [Errno 13] Permission denied: '/app/logs/powermem.log'
PermissionError: [Errno 13] Permission denied: '/app/logs/powermem.log'

The health response then reports:

{
  "status": "degraded",
  "memory_service_ready": false,
  "storage_type": null
}

Reproduction

On a clean Linux checkout, follow the recommended Docker Compose startup guide with a root-owned host log directory:

git clone https://github.com/oceanbase/powermem.git
cd powermem

cp .env.example docker/.env
# Edit docker/.env and configure the LLM provider, model, API key, and base URL.

docker compose -f docker/docker-compose.yml up -d --build

docker compose -f docker/docker-compose.yml logs powermem-server
curl http://localhost:8848/api/v1/system/health

Before this fix, the server process runs as UID 1000 and cannot create /app/logs/powermem.log in the mounted directory, producing the error and degraded response above.

Root Cause

The Compose service bind-mounts ./logs at /app/logs. The image switched to the non-root powermem user before the entrypoint ran. When the host log directory is created as root, the non-root process cannot repair its ownership before PowerMem opens /app/logs/powermem.log.

Solution

• Install gosu in the runtime image.
• Create /app/logs with the expected ownership during the image build.
• Let the entrypoint prepare bind-mounted /app/logs before startup.
• Drop privileges with gosu before launching the requested command, so PowerMem still runs as the non-root powermem user.