fix(installer): mount docker-compose config volume to appuser home

[phernandez]

Summary

• The Dockerfile creates appuser (UID/GID 1000) and switches to it before launching basic-memory.
• docker-compose.yml mounts the persistent config volume at /root/.basic-memory — a directory appuser has no write access to.
• Result: every container start, basic-memory silently re-initializes config + the index DB under /home/appuser/.basic-memory (in the writable layer), and that state is wiped on restart.

This PR moves the mount target to /home/appuser/.basic-memory so the volume actually persists.

Test plan

• Verified Dockerfile:42 runs as appuser and Dockerfile:22 creates --create-home for that user.
• Confirmed BASIC_MEMORY_HOME=/app/data/basic-memory only sets the project-data root, not the CLI config dir, so the CLI default of ~/.basic-memory resolves to /home/appuser/.basic-memory for appuser.
• Manual: docker compose up -d, run basic-memory project add ..., docker compose down && up, confirm config + db persist.

Closes #729

🤖 Generated with Claude Code

[github-actions]

Claude finished @phernandez's task in 1m 28s —— View job

---

PR Review

• Gather context (PR description, changed files)
• Read docker-compose.yml changes
• Read Dockerfile to verify appuser setup
• Review against team checklist
• Post final review

---

Summary

The fix in docker-compose.yml is correct and necessary. The root cause is clear: Dockerfile:42 switches to appuser (created with --create-home on line 22), so ~/.basic-memory resolves to /home/appuser/.basic-memory — not /root/.basic-memory. The old mount silently wrote config to the ephemeral writable layer on every start.

Checklist Results

Area	Status
Fix correctness	✅ Correct path, correct reasoning
Explanatory comment added	✅ Clear inline comment
No security issues	✅
No test changes needed	✅ Infrastructure-only change
Windows compatibility	✅ N/A

Issues Found

1. docs/Docker.md uses the wrong config path throughout (not fixed in this PR)

docs/Docker.md consistently references /app/.basic-memory as the config volume mount target in all examples (lines 18, 33, 70–71, 89–91, 93, 101, 212–213, 251) — but this PR establishes that the correct path is /home/appuser/.basic-memory. This means users following the quick-start docker run instructions in the docs will hit the same bug this PR fixes for docker-compose.yml.

Examples that need updating in docs/Docker.md:

# Current (wrong — appuser can't write here)
-v basic-memory-config:/app/.basic-memory:rw

# Should be
-v basic-memory-config:/home/appuser/.basic-memory:rw

Affected blocks: lines 18, 33, 70–71, 89–91, 93, 101, 212–213, 251.

2. Dockerfile:33 pre-creates /app/.basic-memory — appears unused

RUN mkdir -p /app/data/basic-memory /app/.basic-memory && \
    chown -R appuser:${GID} /app

If the actual CLI config dir is /home/appuser/.basic-memory, then /app/.basic-memory is a leftover directory that does nothing. This is minor (appuser owns it, no security risk), but it could mislead future readers into thinking the config lives there.

Verdict

Approve the docker-compose.yml fix — it directly corrects the broken volume mount that causes config loss on restart.

Suggest following up (can be a separate PR) to:

• Update all docker run / docker-compose examples in docs/Docker.md from /app/.basic-memory → /home/appuser/.basic-memory
• Optionally remove the unused mkdir -p /app/.basic-memory from Dockerfile:33

Fix docs/Docker.md →