Cannot write generated config.yaml to a mounted volume in the container

[SimeonEhrig]

Describe the bug
I want to use the config generate -o option to write the config file to a mounted folder in the container but I get permission denied error.

$ mkdir /tmp/config/
$ sudo docker run -v /tmp/config/:/should_not_exist ghcr.io/element-hq/matrix-authentication-service  config generate -o /should_not_exist/config.yml
2025-08-23T10:16:29.926479Z  INFO mas_config::sections::secrets:312 Generating keys...
2025-08-23T10:16:30.217637Z  INFO mas_config::sections::secrets:319 Done generating RSA key
2025-08-23T10:16:30.217893Z  INFO mas_config::sections::secrets:335 Done generating EC P-256 key
2025-08-23T10:16:30.218157Z  INFO mas_config::sections::secrets:351 Done generating EC P-384 key
2025-08-23T10:16:30.219221Z  INFO mas_config::sections::secrets:367 Done generating EC secp256k1 key
2025-08-23T10:16:30.219617Z  INFO mas_cli::commands::config:115 Writing configuration to "/should_not_exist/config.yml"
Error: Permission denied (os error 13)

I also verified my mount point with a normal Ubuntu container and it is working.

$ ls /tmp/config/
$ sudo docker run -v /tmp/config/:/should_not_exist ubuntu touch /should_not_exist/config.yml
$ ls /tmp/config/
config.yml

To Reproduce
Steps to reproduce the behavior:

1. create an folder for mounting on the host: mkdir /tmp/config/
2. run: sudo docker run -v /tmp/config/:/should_not_exist ghcr.io/element-hq/matrix-authentication-service config generate -o /should_not_exist/config.yml

Expected behavior
The config.yaml should be created in the mounted folder.

[SimeonEhrig]

I found the reason why it is not working. The configuration process inside the container does not run with UID 0. Therefore it has a different user id compare to the mounted folder. The workaround is give others write permission for the mounted folder. A clear solution would be to set the UID via environment variable.

In special, if you use rootless container, like in podman, it make sense to run the processes with UID 0, because the root process in the container is mapped to the user ID of the user, who runs the container.