diff --git a/containers/crowdsec/scripts/crowdsec_install_host.sh b/containers/crowdsec/scripts/crowdsec_install_host.sh
index b7b9225..b151d2d 100644
--- a/containers/crowdsec/scripts/crowdsec_install_host.sh
+++ b/containers/crowdsec/scripts/crowdsec_install_host.sh
@@ -5,7 +5,7 @@
 # mount set takes effect.
 crowdsecToggleLibrePortalLogMounts() {
     local mode="$1"
-    local compose="${containers_dir}libreportal/docker-compose.yml"
+    local compose="$(webuiDir)/docker-compose.yml"
     [[ -f "$compose" ]] || return 0
 
     case "$mode" in
@@ -26,7 +26,7 @@ crowdsecToggleLibrePortalLogMounts() {
 
     if runFileOp docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^libreportal-service$'; then
         isNotice "Recreating libreportal so log mount toggle takes effect..."
-        ( cd "${containers_dir}libreportal" && runAsManager docker compose up -d >/dev/null 2>&1 ) || true
+        ( cd "$(webuiDir)" && runAsManager docker compose up -d >/dev/null 2>&1 ) || true
     fi
 }
 
diff --git a/containers/dashy/scripts/dashy_update_conf.sh b/containers/dashy/scripts/dashy_update_conf.sh
index 5f26dee..8a5e454 100755
--- a/containers/dashy/scripts/dashy_update_conf.sh
+++ b/containers/dashy/scripts/dashy_update_conf.sh
@@ -9,8 +9,8 @@
 appDashyUpdateConf()
 {
     local conf_file="${containers_dir}dashy/etc/conf.yml"
-    local services_json="${containers_dir}libreportal/frontend/data/apps/generated/apps-services.json"
-    local icons_src_dir="${containers_dir}libreportal/frontend/icons/apps"
+    local services_json="$(webuiDir)/frontend/data/apps/generated/apps-services.json"
+    local icons_src_dir="$(webuiDir)/frontend/icons/apps"
 
     # Don't check the apps DB here — appUpdateSpecifics calls us at
     # install step 6, BEFORE databaseInstallApp (step 8) writes the
diff --git a/containers/gluetun/scripts/gluetun_providers.sh b/containers/gluetun/scripts/gluetun_providers.sh
index efba1d7..ed08e0a 100644
--- a/containers/gluetun/scripts/gluetun_providers.sh
+++ b/containers/gluetun/scripts/gluetun_providers.sh
@@ -10,7 +10,7 @@
 # gluetun adds/removes providers and protocols. Falls back silently to the
 # previous snapshot (or the bundled default) on network failure.
 appWebuiRefresh_gluetun() {
-    local output_file="${containers_dir}libreportal/frontend/data/apps/generated/gluetun-providers.json"
+    local output_file="$(webuiDir)/frontend/data/apps/generated/gluetun-providers.json"
     local upstream="https://raw.githubusercontent.com/qdm12/gluetun/master/internal/storage/servers.json"
     local tmp="$(mktemp)"
     local raw="${output_file}.raw.$$"
diff --git a/containers/gluetun/scripts/gluetun_route_apps.sh b/containers/gluetun/scripts/gluetun_route_apps.sh
index 67dc1d4..1ae5d81 100644
--- a/containers/gluetun/scripts/gluetun_route_apps.sh
+++ b/containers/gluetun/scripts/gluetun_route_apps.sh
@@ -5,7 +5,7 @@
 # override flag. Skips itself, Traefik, LibrePortal, fail2ban.
 gluetunRouteExistingAppsPrompt()
 {
-    local categories_file="${containers_dir}libreportal/frontend/data/apps/gluetun-eligible-categories.json"
+    local categories_file="$(webuiDir)/frontend/data/apps/gluetun-eligible-categories.json"
     local override="${CFG_REQUIREMENT_GLUETUN_FOR_ALL:-false}"
 
     if ! command -v sqlite3 >/dev/null 2>&1 || [[ ! -f "$docker_dir/$db_file" ]]; then
diff --git a/containers/libreportal_catalog/scripts/libreportal_catalog_install_hooks.sh b/containers/libreportal_catalog/scripts/libreportal_catalog_install_hooks.sh
index 221d582..4319302 100644
--- a/containers/libreportal_catalog/scripts/libreportal_catalog_install_hooks.sh
+++ b/containers/libreportal_catalog/scripts/libreportal_catalog_install_hooks.sh
@@ -25,7 +25,7 @@ libreportal_catalog_install_post_setup()
     # Bundle the App Center's category icons so the site's sidebar matches the
     # WebUI (same per-category glyphs). Copied from the live frontend so they
     # stay in step; best-effort (the site falls back to misc.svg if absent).
-    local cat_src="$containers_dir/libreportal/frontend/core/icons/categories"
+    local cat_src="$(webuiDir)/frontend/core/icons/categories"
     if [[ -d "$cat_src" ]]; then
         runFileOp mkdir -p "$dest/categories" || true
         runFileOp cp -f "$cat_src"/*.svg "$dest/categories/" 2>/dev/null || true
diff --git a/scripts/cli/commands/app/cli_app_tool_list.sh b/scripts/cli/commands/app/cli_app_tool_list.sh
index 9bc7b82..604b788 100644
--- a/scripts/cli/commands/app/cli_app_tool_list.sh
+++ b/scripts/cli/commands/app/cli_app_tool_list.sh
@@ -12,7 +12,7 @@
 cliAppToolList()
 {
     local filter_app="$1"
-    local manifest="$containers_dir/libreportal/frontend/data/apps/generated/apps-tools.json"
+    local manifest="$(webuiDir)/frontend/data/apps/generated/apps-tools.json"
 
     if [[ ! -f "$manifest" ]]; then
         isError "apps-tools.json not found at $manifest. Run the WebUI updater to generate it."
diff --git a/scripts/cli/commands/updater/cli_updater_commands.sh b/scripts/cli/commands/updater/cli_updater_commands.sh
index 1ae9102..f6d4272 100644
--- a/scripts/cli/commands/updater/cli_updater_commands.sh
+++ b/scripts/cli/commands/updater/cli_updater_commands.sh
@@ -194,7 +194,7 @@ updaterSetAnchorRef()
 # — i.e. the roll-back target. Read from history.json's most recent update/ok.
 updaterLastUpdateFrom()
 {
-    local app="$1" hist="$containers_dir/libreportal/frontend/data/updater/generated/history.json"
+    local app="$1" hist="$(webuiDir)/frontend/data/updater/generated/history.json"
     [ -f "$hist" ] && command -v jq >/dev/null 2>&1 || return 0
     jq -r --arg a "$app" 'first(.entries[]? | select(.app==$a and .action=="update" and .result=="ok") | .from) // ""' "$hist" 2>/dev/null
 }
@@ -336,7 +336,7 @@ updaterRecordHistory()
 {
     local app="$1" action="$2" from="$3" to="$4" result="$5"
     local artifact_id="${6:-}" serial="${7:-}" undo_id="${8:-}" trigger="${9:-manual}"
-    local f="$containers_dir/libreportal/frontend/data/updater/generated/history.json"
+    local f="$(webuiDir)/frontend/data/updater/generated/history.json"
     local ts; ts="$(date -Iseconds 2>/dev/null || date)"
     [ -f "$f" ] || printf '{ "entries": [] }\n' | runFileWrite "$f"
 
diff --git a/scripts/cli/commands/webui/cli_webui_commands.sh b/scripts/cli/commands/webui/cli_webui_commands.sh
index 3fe4881..2220f9d 100755
--- a/scripts/cli/commands/webui/cli_webui_commands.sh
+++ b/scripts/cli/commands/webui/cli_webui_commands.sh
@@ -71,7 +71,7 @@ cliHandleWebuiCommands()
 
 cliWebuiLoginReset()
 {
-    local auth_file="$containers_dir/libreportal/frontend/.auth.json"
+    local auth_file="$(webuiDir)/frontend/.auth.json"
     local webui_logins_file="$configs_dir/webui/webui_logins"
 
     isNotice "Resetting WebUI credentials..."
diff --git a/scripts/cli/task/cli_task_run.sh b/scripts/cli/task/cli_task_run.sh
index 191e0d6..347be05 100644
--- a/scripts/cli/task/cli_task_run.sh
+++ b/scripts/cli/task/cli_task_run.sh
@@ -21,7 +21,7 @@
 # crontab_task_processor.sh and webui_task_create.sh use; if those move, both
 # this file and they have to update together.
 _taskDir() {
-    echo "${containers_dir}libreportal/frontend/data/tasks"
+    echo "$(webuiDir)/frontend/data/tasks"
 }
 
 _genTaskId() {
diff --git a/scripts/config/core/variables/config_scan_variables.sh b/scripts/config/core/variables/config_scan_variables.sh
index 944dfe3..3d26c12 100755
--- a/scripts/config/core/variables/config_scan_variables.sh
+++ b/scripts/config/core/variables/config_scan_variables.sh
@@ -142,7 +142,7 @@ reconcileConfigFile()
     if [[ -s "$tmp" ]] && grep -q '^CFG_' "$tmp" && ! runInstallOp cmp -s "$tmp" "$live"; then
         local bak_file="${live%/*}/.${live##*/}.bak"
         runCfgOp cp -a "$live" "$bak_file"
-        { [[ -n "$containers_dir" && "$live" == "$containers_dir"* ]] && runFileWrite "$live" < "$tmp" || runInstallOp cp "$tmp" "$live"; }
+        { pathIsContainerData "$live" && runFileWrite "$live" < "$tmp" || runInstallOp cp "$tmp" "$live"; }
         # A hidden .<file>.bak sibling is still written above for safety; the
         # per-file result is intentionally silent — the intro notice and the
         # per-section "...completed." lines are the only reconcile output.
diff --git a/scripts/config/tags/manager/tags_manager_update.sh b/scripts/config/tags/manager/tags_manager_update.sh
index 5c72ab8..449b89e 100755
--- a/scripts/config/tags/manager/tags_manager_update.sh
+++ b/scripts/config/tags/manager/tags_manager_update.sh
@@ -51,6 +51,6 @@ tagsManagerUpdateUniversalTag()
     # manager-owned configs/ + install templates use runInstallOp. The read
     # (awk above) needs no escalation — config/compose files are world-readable.
     local op="runInstallOp"
-    [[ "$file_path" == "$containers_dir"* || "$file_path" == "${LP_CONTAINERS_DIR:-/libreportal-containers}"/* ]] && op="runFileOp"
+    pathIsContainerData "$file_path" && op="runFileOp"
     $op sed -i "/#LIBREPORTAL|${tag_name}|/s|${esc_placeholder}|${esc_new}|g" "$file_path"
 }
diff --git a/scripts/docker/app/uninstall/uninstall_app.sh b/scripts/docker/app/uninstall/uninstall_app.sh
index 4138932..c3a46dd 100755
--- a/scripts/docker/app/uninstall/uninstall_app.sh
+++ b/scripts/docker/app/uninstall/uninstall_app.sh
@@ -89,7 +89,7 @@ dockerUninstallApp()
         # scan happened to run. Surgical delete rather than a rescan: a full
         # updater scan re-runs CVE checks against every image and has no place
         # inside an uninstall.
-        local _upd_gen="${containers_dir}libreportal/frontend/data/updater/generated"
+        local _upd_gen="$(webuiDir)/frontend/data/updater/generated"
         local _upd_f
         for _upd_f in updates.json cves.json; do
             if [[ -f "$_upd_gen/$_upd_f" ]] && command -v jq >/dev/null 2>&1; then
@@ -114,7 +114,7 @@ dockerUninstallApp()
             echo ""
             echo "---- $menu_number. Removing related task history"
             echo ""
-            local _tasks_dir="${containers_dir}libreportal/frontend/data/tasks"
+            local _tasks_dir="$(webuiDir)/frontend/data/tasks"
             local _removed=0
             if [[ -d "$_tasks_dir" ]]; then
                 for _tf in "$_tasks_dir"/task_*.json; do
diff --git a/scripts/docker/command/run_privileged.sh b/scripts/docker/command/run_privileged.sh
index 3c635dd..a03952e 100644
--- a/scripts/docker/command/run_privileged.sh
+++ b/scripts/docker/command/run_privileged.sh
@@ -91,13 +91,33 @@ runInstallWrite() {
 # file" bug — the substitution silently failed, leaving the placeholder).
 runCfgOp() {
     local _file="${!#}"
-    if [[ -n "$containers_dir" && "$_file" == "$containers_dir"* ]]; then
+    if _runCfgIsContainerPath "$_file"; then
         runFileOp "$@"
     else
         runInstallOp "$@"
     fi
 }
 
+# paths.sh owns pathIsContainerData (it knows every registered storage root).
+# init.sh sources THIS file directly at install time WITHOUT paths.sh, so fall
+# back to the primary root alone — at install no extra locations exist yet, so
+# the two answers agree.
+#
+# Deliberately not named pathIsContainerData: a same-named top-level definition
+# here gets indexed by generate_function_manifest.sh, and the resulting autoload
+# stub would shadow the real multi-root implementation with this primary-only
+# one — silently classifying every file on a second disk as manager-owned.
+_runCfgIsContainerPath() {
+    local p="$1"
+    if declare -F pathIsContainerData >/dev/null 2>&1; then
+        pathIsContainerData "$p"
+        return $?
+    fi
+    local root="${LP_CONTAINERS_DIR:-/libreportal-containers}"
+    root="${root%/}"
+    [[ -n "$p" && ( "$p" == "$root" || "$p" == "$root/"* ) ]]
+}
+
 # Backup-engine command (borg/restic/kopia) run AS the dedicated backup user
 # ($docker_install_user), with the repo password and BORG_/RESTIC_/KOPIA_ env
 # vars carried across the privilege drop. Never root — the scoped sudoers lets
diff --git a/scripts/docker/command/stranded_containers.sh b/scripts/docker/command/stranded_containers.sh
index 96c2f37..947de5f 100644
--- a/scripts/docker/command/stranded_containers.sh
+++ b/scripts/docker/command/stranded_containers.sh
@@ -43,7 +43,7 @@ dockerRemoveStrandedContainers()
         [[ -z "$name" || -z "$work_dir" ]] && continue
         # Only LibrePortal's own container tree, and only when the project
         # directory is provably gone.
-        [[ "$work_dir" == "$containers_dir"* ]] || continue
+        pathIsContainerData "$work_dir" || continue
         [[ -d "$work_dir" ]] && continue
 
         if runFileOp docker rm -f "$name" >/dev/null 2>&1; then
diff --git a/scripts/docker/health/docker_health_scan.sh b/scripts/docker/health/docker_health_scan.sh
index a32c073..6bc413c 100644
--- a/scripts/docker/health/docker_health_scan.sh
+++ b/scripts/docker/health/docker_health_scan.sh
@@ -67,7 +67,7 @@ dockerHealthScan() {
     # $state_file, written ONLY by the throttled caller (webuiSystemHealthCheck)
     # via HEALTH_RESTART_SNAPSHOT, so the heal's rapid re-scans don't disturb the
     # baseline. One inspect over all containers (name|count|status|restarting).
-    local state_file="${containers_dir}/libreportal/frontend/data/system/.health_restart_counts"
+    local state_file="$(webuiDir)/frontend/data/system/.health_restart_counts"
     HEALTH_RESTART_SNAPSHOT=""
 
     declare -A _prev_rc=()
diff --git a/scripts/function/file/copy_file.sh b/scripts/function/file/copy_file.sh
index b7f85fb..d6431bf 100755
--- a/scripts/function/file/copy_file.sh
+++ b/scripts/function/file/copy_file.sh
@@ -17,7 +17,7 @@ copyFile()
     # the manager-owned control plane (configs/logs/etc.) is runInstallOp.
     # Mirrors createTouch's path-based ownership; $user_name is now advisory.
     local op="runInstallOp"
-    [[ "$save_dir" == "$containers_dir"* || "$save_dir" == "${LP_CONTAINERS_DIR:-/libreportal-containers}"/* ]] && op="runFileOp"
+    pathIsContainerData "$save_dir" && op="runFileOp"
 
     if [ "$silent_flag" == "loud" ]; then
         local result; result=$($op cp $flags_full "$file" "$save_dir")
@@ -43,7 +43,7 @@ repairStubDirForFile()
     [[ -d "$target" ]] || return 0
 
     local op="runInstallOp"
-    [[ "$target" == "$containers_dir"* || "$target" == "${LP_CONTAINERS_DIR:-/libreportal-containers}"/* ]] && op="runFileOp"
+    pathIsContainerData "$target" && op="runFileOp"
 
     local name; name=$(basename "$target")
     local staged="$target.stub-repair.$$"
diff --git a/scripts/function/file/copy_files.sh b/scripts/function/file/copy_files.sh
index 8852b94..ff75039 100755
--- a/scripts/function/file/copy_files.sh
+++ b/scripts/function/file/copy_files.sh
@@ -9,7 +9,7 @@ copyFiles()
 
     # Write as the destination's owner (see copyFile).
     local op="runInstallOp"
-    [[ "$save_dir" == "$containers_dir"* || "$save_dir" == "${LP_CONTAINERS_DIR:-/libreportal-containers}"/* ]] && op="runFileOp"
+    pathIsContainerData "$save_dir" && op="runFileOp"
 
     local files=($($op find "$source" -type f))
     if [ ${#files[@]} -eq 0 ]; then
diff --git a/scripts/function/file/create_touch.sh b/scripts/function/file/create_touch.sh
index 9ee8312..0ec54d6 100755
--- a/scripts/function/file/create_touch.sh
+++ b/scripts/function/file/create_touch.sh
@@ -21,7 +21,7 @@ createTouch()
     local file_dir=$(dirname "$clean_file")
 
     local op="runInstallOp"
-    if [[ "$clean_file" == "$containers_dir"* || "$clean_file" == "${LP_CONTAINERS_DIR:-/libreportal-containers}"/* ]]; then
+    if pathIsContainerData "$clean_file"; then
         op="runFileOp"
     fi
 
diff --git a/scripts/function/file/move_file.sh b/scripts/function/file/move_file.sh
index af118e9..2e83392 100755
--- a/scripts/function/file/move_file.sh
+++ b/scripts/function/file/move_file.sh
@@ -10,7 +10,7 @@ moveFile()
     if [ -e "$file" ]; then
         # Move as the destination's owner — no root, no chown (see copyFile).
         local op="runInstallOp"
-        [[ "$save_dir" == "$containers_dir"* || "$save_dir" == "${LP_CONTAINERS_DIR:-/libreportal-containers}"/* ]] && op="runFileOp"
+        pathIsContainerData "$save_dir" && op="runFileOp"
         local result; result=$($op mv "$file" "$save_dir")
         checkSuccess "Moving $file_name to $save_dir"
     else
diff --git a/scripts/function/folder/copy_folder.sh b/scripts/function/folder/copy_folder.sh
index af567d7..d2730e6 100755
--- a/scripts/function/folder/copy_folder.sh
+++ b/scripts/function/folder/copy_folder.sh
@@ -8,8 +8,8 @@ copyFolder()
     local user_name="$3"   # advisory — the destination path determines the owner
 
     # Write as the destination's owner — no root, no chown (see copyFile).
-    if [[ "$save_dir" == "$containers_dir"* || "$save_dir" == "${LP_CONTAINERS_DIR:-/libreportal-containers}"/* ]]; then
-        if [[ "$folder" == "$containers_dir"* || "$folder" == "${LP_CONTAINERS_DIR:-/libreportal-containers}"/* ]]; then
+    if pathIsContainerData "$save_dir"; then
+        if pathIsContainerData "$folder"; then
             # container -> container: same owner (dockerinstall), a plain cp works.
             local result; result=$(runFileOp cp -rf "$folder" "$save_dir")
         else
diff --git a/scripts/function/folder/copy_folders.sh b/scripts/function/folder/copy_folders.sh
index 1829c1b..208e55d 100755
--- a/scripts/function/folder/copy_folders.sh
+++ b/scripts/function/folder/copy_folders.sh
@@ -8,7 +8,7 @@ copyFolders()
 
     # Write as the destination's owner — no root, no chown (see copyFile).
     local op="runInstallOp"
-    [[ "$save_dir" == "$containers_dir"* || "$save_dir" == "${LP_CONTAINERS_DIR:-/libreportal-containers}"/* ]] && op="runFileOp"
+    pathIsContainerData "$save_dir" && op="runFileOp"
 
     local subdirs=($(find "$source" -mindepth 1 -maxdepth 1 -type d))
     if [ ${#subdirs[@]} -eq 0 ]; then
diff --git a/scripts/function/folder/create_folder.sh b/scripts/function/folder/create_folder.sh
index 6acd57b..0aa7bd5 100755
--- a/scripts/function/folder/create_folder.sh
+++ b/scripts/function/folder/create_folder.sh
@@ -14,7 +14,7 @@ createFolders()
         # AS that user via runFileOp — creating it as the right owner avoids a
         # chown-to-another-user the unprivileged runtime can't do. Mirrors
         # createTouch; the $user_name hint is advisory for these paths.
-        if [[ "$clean_dir" == "$containers_dir"* || "$clean_dir" == "${LP_CONTAINERS_DIR:-/libreportal-containers}"/* ]]; then
+        if pathIsContainerData "$clean_dir"; then
             if [ ! -d "$dir_path" ]; then
                 local result; result=$(runFileOp mkdir -p "$dir_path")
                 [ "$silent_flag" == "loud" ] && checkSuccess "Creating $folder_name directory"
diff --git a/scripts/setup/setup_apply.sh b/scripts/setup/setup_apply.sh
index a8e318f..a561e9e 100644
--- a/scripts/setup/setup_apply.sh
+++ b/scripts/setup/setup_apply.sh
@@ -125,7 +125,7 @@ setupApplyFinalize()
     # failed app's own task row is already red; the WebUI watcher is what gates
     # the "your install is ready" hand-off on this same group-level result.
     if [[ -n "$setup_group" ]]; then
-        local tasks_dir="${containers_dir}libreportal/frontend/data/tasks"
+        local tasks_dir="$(webuiDir)/frontend/data/tasks"
         local total=0 failed=0 failed_names="" f
         if [[ -d "$tasks_dir" ]]; then
             for f in "$tasks_dir"/task_*.json; do
diff --git a/scripts/setup/setup_lock.sh b/scripts/setup/setup_lock.sh
index 909bbef..e0532bd 100644
--- a/scripts/setup/setup_lock.sh
+++ b/scripts/setup/setup_lock.sh
@@ -1,21 +1,27 @@
 #!/bin/bash
 
-SETUP_LOCK_FILE="${containers_dir}libreportal/frontend/data/.setup_complete"
+# Resolved on call, not at source time: this file can be sourced by the lazy
+# loader before paths.sh has run, and a source-time expansion would bake an
+# empty root into an absolute-looking path.
+setupLockFile()
+{
+    printf '%s' "$(webuiDir)/frontend/data/.setup_complete"
+}
 
 isSetupWizardComplete()
 {
-    [[ -f "$SETUP_LOCK_FILE" ]]
+    [[ -f "$(setupLockFile)" ]]
 }
 
 setupWizardMarkComplete()
 {
     # .setup_complete lives in the docker-install-owned frontend/data -> runFileOp
     # (created as that user; no root, no chown).
-    runFileOp touch "$SETUP_LOCK_FILE" 2>/dev/null
-    runFileOp chmod 644 "$SETUP_LOCK_FILE" 2>/dev/null
+    runFileOp touch "$(setupLockFile)" 2>/dev/null
+    runFileOp chmod 644 "$(setupLockFile)" 2>/dev/null
 }
 
 setupWizardReset()
 {
-    runFileOp rm -f "$SETUP_LOCK_FILE" 2>/dev/null
+    runFileOp rm -f "$(setupLockFile)" 2>/dev/null
 }
diff --git a/scripts/source/files/arrays/function_manifest.sh b/scripts/source/files/arrays/function_manifest.sh
index e0b66c8..5394564 100644
--- a/scripts/source/files/arrays/function_manifest.sh
+++ b/scripts/source/files/arrays/function_manifest.sh
@@ -915,6 +915,7 @@ declare -gA LP_FN_MAP=(
     [runAsManager]="docker/command/run_privileged.sh"
     [runBackupOp]="docker/command/run_privileged.sh"
     [runBinInstall]="docker/command/run_privileged.sh"
+    [_runCfgIsContainerPath]="docker/command/run_privileged.sh"
     [runCfgOp]="docker/command/run_privileged.sh"
     [runCrowdsec]="docker/command/run_privileged.sh"
     [runFileOp]="docker/command/run_privileged.sh"
@@ -951,6 +952,7 @@ declare -gA LP_FN_MAP=(
     [setupHeadscaleUser]="headscale/scripts/headscale_user.sh"
     [setupHeadscaleVariables]="network/variables/headscale_variables.sh"
     [setupLocalDnsRewrites]="network/dns/setup_local_dns.sh"
+    [setupLockFile]="setup/setup_lock.sh"
     [setupTaskDir]="task/crontab_task_processor.sh"
     [setupWizardMarkComplete]="setup/setup_lock.sh"
     [setupWizardReset]="setup/setup_lock.sh"
@@ -2097,6 +2099,7 @@ declare -gA LP_FN_ROOT=(
     [runAsManager]="scripts"
     [runBackupOp]="scripts"
     [runBinInstall]="scripts"
+    [_runCfgIsContainerPath]="scripts"
     [runCfgOp]="scripts"
     [runCrowdsec]="scripts"
     [runFileOp]="scripts"
@@ -2133,6 +2136,7 @@ declare -gA LP_FN_ROOT=(
     [setupHeadscaleUser]="containers"
     [setupHeadscaleVariables]="scripts"
     [setupLocalDnsRewrites]="scripts"
+    [setupLockFile]="scripts"
     [setupTaskDir]="scripts"
     [setupWizardMarkComplete]="scripts"
     [setupWizardReset]="scripts"
@@ -2387,7 +2391,6 @@ LP_EAGER_FILES=(
     "containers:matrix/scripts/matrix_auth.sh"
     "scripts:migrate/migrate_url_rewrite.sh"
     "containers:nextcloud/scripts/nextcloud_upgrade_hooks.sh"
-    "scripts:setup/setup_lock.sh"
     "scripts:source/artifacts.sh"
     "scripts:task/crontab_check_processor.sh"
     "scripts:task/crontab_task_processor.sh"
@@ -3316,6 +3319,7 @@ runAppCfg() { unset -f runAppCfg; __lpAutoload "${install_scripts_dir}docker/com
 runAsManager() { unset -f runAsManager; __lpAutoload "${install_scripts_dir}docker/command/run_privileged.sh"; runAsManager "$@"; }
 runBackupOp() { unset -f runBackupOp; __lpAutoload "${install_scripts_dir}docker/command/run_privileged.sh"; runBackupOp "$@"; }
 runBinInstall() { unset -f runBinInstall; __lpAutoload "${install_scripts_dir}docker/command/run_privileged.sh"; runBinInstall "$@"; }
+_runCfgIsContainerPath() { unset -f _runCfgIsContainerPath; __lpAutoload "${install_scripts_dir}docker/command/run_privileged.sh"; _runCfgIsContainerPath "$@"; }
 runCfgOp() { unset -f runCfgOp; __lpAutoload "${install_scripts_dir}docker/command/run_privileged.sh"; runCfgOp "$@"; }
 runCrowdsec() { unset -f runCrowdsec; __lpAutoload "${install_scripts_dir}docker/command/run_privileged.sh"; runCrowdsec "$@"; }
 runFileOp() { unset -f runFileOp; __lpAutoload "${install_scripts_dir}docker/command/run_privileged.sh"; runFileOp "$@"; }
@@ -3352,6 +3356,7 @@ setupHeadscaleRemote() { unset -f setupHeadscaleRemote; __lpAutoload "${install_
 setupHeadscaleUser() { unset -f setupHeadscaleUser; __lpAutoload "${install_containers_dir}headscale/scripts/headscale_user.sh"; setupHeadscaleUser "$@"; }
 setupHeadscaleVariables() { unset -f setupHeadscaleVariables; __lpAutoload "${install_scripts_dir}network/variables/headscale_variables.sh"; setupHeadscaleVariables "$@"; }
 setupLocalDnsRewrites() { unset -f setupLocalDnsRewrites; __lpAutoload "${install_scripts_dir}network/dns/setup_local_dns.sh"; setupLocalDnsRewrites "$@"; }
+setupLockFile() { unset -f setupLockFile; __lpAutoload "${install_scripts_dir}setup/setup_lock.sh"; setupLockFile "$@"; }
 setupTaskDir() { unset -f setupTaskDir; __lpAutoload "${install_scripts_dir}task/crontab_task_processor.sh"; setupTaskDir "$@"; }
 setupWizardMarkComplete() { unset -f setupWizardMarkComplete; __lpAutoload "${install_scripts_dir}setup/setup_lock.sh"; setupWizardMarkComplete "$@"; }
 setupWizardReset() { unset -f setupWizardReset; __lpAutoload "${install_scripts_dir}setup/setup_lock.sh"; setupWizardReset "$@"; }
diff --git a/scripts/task/crontab_setup_check_processor.sh b/scripts/task/crontab_setup_check_processor.sh
index e75e9d5..63c24e1 100755
--- a/scripts/task/crontab_setup_check_processor.sh
+++ b/scripts/task/crontab_setup_check_processor.sh
@@ -3,7 +3,7 @@
 crontabSetupCheckProcessor() 
 {
   local task_check_script="$install_scripts_dir/task/crontab_check_processor.sh"
-  local task_dir="$containers_dir/libreportal/frontend/data/tasks"
+  local task_dir="$(webuiDir)/frontend/data/tasks"
   
   # Update TASK_DIR in the task processor script
   if [ -f "$task_check_script" ]; then
diff --git a/scripts/task/crontab_setup_task_processor.sh b/scripts/task/crontab_setup_task_processor.sh
index a3d7af1..720af18 100755
--- a/scripts/task/crontab_setup_task_processor.sh
+++ b/scripts/task/crontab_setup_task_processor.sh
@@ -3,7 +3,7 @@
 crontabSetupTaskProcessor() 
 {
   local task_processor_script="$install_scripts_dir/task/crontab_task_processor.sh"
-  local task_dir="$containers_dir/libreportal/frontend/data/tasks"
+  local task_dir="$(webuiDir)/frontend/data/tasks"
   
   # Update TASK_DIR in the task processor script
   if [ -f "$task_processor_script" ]; then
diff --git a/scripts/webui/data/generators/apps/webui_app_status.sh b/scripts/webui/data/generators/apps/webui_app_status.sh
index 8bfd6c3..fec14cc 100755
--- a/scripts/webui/data/generators/apps/webui_app_status.sh
+++ b/scripts/webui/data/generators/apps/webui_app_status.sh
@@ -3,7 +3,7 @@
 # Update a specific app's status in apps.json (used for install/uninstall operations)
 webuiUpdateAppStatus() {
     local app_name="$1"
-    local output_file="${containers_dir}libreportal/frontend/data/apps/generated/apps.json"
+    local output_file="$(webuiDir)/frontend/data/apps/generated/apps.json"
     
     if [[ -z "$app_name" ]]; then
         isError "app_name parameter required for webuiUpdateAppStatus"
diff --git a/scripts/webui/data/generators/apps/webui_config.sh b/scripts/webui/data/generators/apps/webui_config.sh
index 89ea809..54c229d 100644
--- a/scripts/webui/data/generators/apps/webui_config.sh
+++ b/scripts/webui/data/generators/apps/webui_config.sh
@@ -33,7 +33,7 @@ _webuiReadServiceTags() {
 webuiGenerateLibrePortalConfig() {
     local testing_mode="$1"
     local specific_app="$2"
-    local output_file="${containers_dir}libreportal/frontend/data/apps/generated/apps.json"
+    local output_file="$(webuiDir)/frontend/data/apps/generated/apps.json"
     local first_app=true
     local app_count=0
 
@@ -162,7 +162,7 @@ EOF
             icon_file="$app_name.png"
         fi
         if [[ -n "$icon_file" ]]; then
-            local icons_apps_dir="${containers_dir}libreportal/frontend/core/icons/apps"
+            local icons_apps_dir="$(webuiDir)/frontend/core/icons/apps"
             runFileOp mkdir -p "$icons_apps_dir"
             runFileWrite "$icons_apps_dir/$icon_file" < "$dir/$icon_file" 2>/dev/null
         fi
diff --git a/scripts/webui/data/generators/apps/webui_config_patch.sh b/scripts/webui/data/generators/apps/webui_config_patch.sh
index 123d15d..dcbac80 100644
--- a/scripts/webui/data/generators/apps/webui_config_patch.sh
+++ b/scripts/webui/data/generators/apps/webui_config_patch.sh
@@ -7,7 +7,7 @@ webuiPatchAppConfigJson() {
     local app_name="$1"
     [[ -z "$app_name" ]] && return 1
 
-    local apps_json="${containers_dir}libreportal/frontend/data/apps/generated/apps.json"
+    local apps_json="$(webuiDir)/frontend/data/apps/generated/apps.json"
     [[ ! -f "$apps_json" ]] && return 1
 
     local deployed_cfg="${containers_dir}${app_name}/${app_name}.config"
diff --git a/scripts/webui/data/generators/apps/webui_services.sh b/scripts/webui/data/generators/apps/webui_services.sh
index 34f0499..14f1010 100755
--- a/scripts/webui/data/generators/apps/webui_services.sh
+++ b/scripts/webui/data/generators/apps/webui_services.sh
@@ -4,7 +4,7 @@
 # Generates apps-services.json from database
 webuiGenerateAppsServicesConfig() {
     local testing_mode="$1"
-    local output_file="${containers_dir}libreportal/frontend/data/apps/generated/apps-services.json"
+    local output_file="$(webuiDir)/frontend/data/apps/generated/apps-services.json"
     local first_service=true
     local service_count=0
     
@@ -81,8 +81,8 @@ EOF
                         # source IP of the default route) is what LAN/VPN clients dial,
                         # and matches the host APP_URL is stamped with.
                         local server_ip=""
-                        if [[ -f "${containers_dir}libreportal/config/generated/configs.json" ]]; then
-                            server_ip=$(grep -o '"CFG_SERVER_IP":[[:space:]]*"[^"]*"' "${containers_dir}libreportal/config/generated/configs.json" | cut -d'"' -f4)
+                        if [[ -f "$(webuiDir)/config/generated/configs.json" ]]; then
+                            server_ip=$(grep -o '"CFG_SERVER_IP":[[:space:]]*"[^"]*"' "$(webuiDir)/config/generated/configs.json" | cut -d'"' -f4)
                         fi
                         [[ -z "$server_ip" ]] && server_ip="${local_ip_v4:-localhost}"
                         [[ -z "$server_ip" ]] && server_ip="localhost"
diff --git a/scripts/webui/data/generators/apps/webui_tools.sh b/scripts/webui/data/generators/apps/webui_tools.sh
index b40e5b7..1d63358 100644
--- a/scripts/webui/data/generators/apps/webui_tools.sh
+++ b/scripts/webui/data/generators/apps/webui_tools.sh
@@ -47,7 +47,7 @@ webuiGenerateAppsToolsConfig() {
         return $?
     fi
 
-    local output_file="${containers_dir}libreportal/frontend/data/apps/generated/apps-tools.json"
+    local output_file="$(webuiDir)/frontend/data/apps/generated/apps-tools.json"
     local tmp="$(mktemp)"
 
     runFileOp mkdir -p "$(dirname "$output_file")"
diff --git a/scripts/webui/data/generators/backup/webui_backup_app_status.sh b/scripts/webui/data/generators/backup/webui_backup_app_status.sh
index b1cde78..1d29738 100644
--- a/scripts/webui/data/generators/backup/webui_backup_app_status.sh
+++ b/scripts/webui/data/generators/backup/webui_backup_app_status.sh
@@ -3,7 +3,7 @@
 webuiGenerateBackupAppStatus()
 {
     local app_name="${1:-}"
-    local output_dir="$containers_dir/libreportal/frontend/data/backup/generated/apps"
+    local output_dir="$(webuiDir)/frontend/data/backup/generated/apps"
     runFileOp mkdir -p "$output_dir"
 
     # Resolve the app list: a single app (direct call — e.g. right after that
diff --git a/scripts/webui/data/generators/backup/webui_backup_dashboard.sh b/scripts/webui/data/generators/backup/webui_backup_dashboard.sh
index e9d424a..dd0b200 100644
--- a/scripts/webui/data/generators/backup/webui_backup_dashboard.sh
+++ b/scripts/webui/data/generators/backup/webui_backup_dashboard.sh
@@ -2,7 +2,7 @@
 
 webuiGenerateBackupDashboard()
 {
-    local output_dir="$containers_dir/libreportal/frontend/data/backup/generated"
+    local output_dir="$(webuiDir)/frontend/data/backup/generated"
     local output_file="$output_dir/dashboard.json"
     local temp_file="${output_file}.tmp.$$"
 
diff --git a/scripts/webui/data/generators/backup/webui_backup_engines.sh b/scripts/webui/data/generators/backup/webui_backup_engines.sh
index 94aeb7b..b24c58c 100644
--- a/scripts/webui/data/generators/backup/webui_backup_engines.sh
+++ b/scripts/webui/data/generators/backup/webui_backup_engines.sh
@@ -7,7 +7,7 @@
 webuiGenerateBackupEngines()
 {
     local src_dir="$install_scripts_dir/backup/engines"
-    local out_dir="$containers_dir/libreportal/frontend/data/backup/generated/engines"
+    local out_dir="$(webuiDir)/frontend/data/backup/generated/engines"
     runFileOp mkdir -p "$out_dir"
 
     if [[ ! -d "$src_dir" ]]; then
diff --git a/scripts/webui/data/generators/backup/webui_backup_locations.sh b/scripts/webui/data/generators/backup/webui_backup_locations.sh
index 4a01739..f4fc7fa 100644
--- a/scripts/webui/data/generators/backup/webui_backup_locations.sh
+++ b/scripts/webui/data/generators/backup/webui_backup_locations.sh
@@ -2,7 +2,7 @@
 
 webuiGenerateBackupLocations()
 {
-    local output_dir="$containers_dir/libreportal/frontend/data/backup/generated"
+    local output_dir="$(webuiDir)/frontend/data/backup/generated"
     local output_file="$output_dir/locations.json"
     local temp_file="${output_file}.tmp.$$"
     runFileOp mkdir -p "$output_dir"
diff --git a/scripts/webui/data/generators/backup/webui_backup_migrate.sh b/scripts/webui/data/generators/backup/webui_backup_migrate.sh
index 51c85ee..cbbf800 100644
--- a/scripts/webui/data/generators/backup/webui_backup_migrate.sh
+++ b/scripts/webui/data/generators/backup/webui_backup_migrate.sh
@@ -11,7 +11,7 @@
 
 webuiGenerateBackupMigrate()
 {
-    local output_dir="$containers_dir/libreportal/frontend/data/backup/generated"
+    local output_dir="$(webuiDir)/frontend/data/backup/generated"
     local output_file="$output_dir/migrate.json"
 
     runFileOp mkdir -p "$output_dir"
diff --git a/scripts/webui/data/generators/backup/webui_backup_passwords.sh b/scripts/webui/data/generators/backup/webui_backup_passwords.sh
index 38ea7f8..796b70b 100644
--- a/scripts/webui/data/generators/backup/webui_backup_passwords.sh
+++ b/scripts/webui/data/generators/backup/webui_backup_passwords.sh
@@ -2,7 +2,7 @@
 
 webuiGenerateBackupPasswords()
 {
-    local output_dir="$containers_dir/libreportal/frontend/data/backup/generated"
+    local output_dir="$(webuiDir)/frontend/data/backup/generated"
     local output_file="$output_dir/passwords.txt"
     local temp_file="${output_file}.tmp.$$"
 
diff --git a/scripts/webui/data/generators/backup/webui_backup_schema.sh b/scripts/webui/data/generators/backup/webui_backup_schema.sh
index 8790d6d..4e8f470 100644
--- a/scripts/webui/data/generators/backup/webui_backup_schema.sh
+++ b/scripts/webui/data/generators/backup/webui_backup_schema.sh
@@ -10,7 +10,7 @@
 
 webuiGenerateBackupSchema()
 {
-    local out_dir="$containers_dir/libreportal/frontend/data/backup/generated"
+    local out_dir="$(webuiDir)/frontend/data/backup/generated"
     local out_file="$out_dir/schema.json"
     runFileOp mkdir -p "$out_dir"
 
diff --git a/scripts/webui/data/generators/backup/webui_backup_snapshots.sh b/scripts/webui/data/generators/backup/webui_backup_snapshots.sh
index b927202..aa758dd 100644
--- a/scripts/webui/data/generators/backup/webui_backup_snapshots.sh
+++ b/scripts/webui/data/generators/backup/webui_backup_snapshots.sh
@@ -3,7 +3,7 @@
 webuiGenerateBackupSnapshots()
 {
     local scope="${1:-all}"
-    local output_dir="$containers_dir/libreportal/frontend/data/backup/generated"
+    local output_dir="$(webuiDir)/frontend/data/backup/generated"
     runFileOp mkdir -p "$output_dir"
 
     local indices=()
diff --git a/scripts/webui/data/generators/backup/webui_task_create.sh b/scripts/webui/data/generators/backup/webui_task_create.sh
index c8e0e20..aabb689 100755
--- a/scripts/webui/data/generators/backup/webui_task_create.sh
+++ b/scripts/webui/data/generators/backup/webui_task_create.sh
@@ -14,7 +14,7 @@ createTaskFile() {
     fi
 
     # Set task directory
-    local task_dir="${containers_dir}libreportal/frontend/data/tasks"
+    local task_dir="$(webuiDir)/frontend/data/tasks"
 
     # Ensure task directory exists (container-owned WebUI data tree -> runFileOp)
     if [ ! -d "$task_dir" ]; then
diff --git a/scripts/webui/data/generators/config/webui_generate_configs.sh b/scripts/webui/data/generators/config/webui_generate_configs.sh
index c241ead..d6a5fdf 100755
--- a/scripts/webui/data/generators/config/webui_generate_configs.sh
+++ b/scripts/webui/data/generators/config/webui_generate_configs.sh
@@ -78,7 +78,7 @@ webuiGenerateSystemConfigs() {
         fi
     }
 
-    local output_file="${containers_dir}libreportal/frontend/data/config/generated/configs.json"
+    local output_file="$(webuiDir)/frontend/data/config/generated/configs.json"
     local temp_file="$(mktemp)"
 
     runFileOp mkdir -p "$(dirname "$output_file")"
diff --git a/scripts/webui/data/generators/peers/webui_peers.sh b/scripts/webui/data/generators/peers/webui_peers.sh
index 2652427..0258e03 100644
--- a/scripts/webui/data/generators/peers/webui_peers.sh
+++ b/scripts/webui/data/generators/peers/webui_peers.sh
@@ -8,7 +8,7 @@
 
 webuiGeneratePeers()
 {
-    local output_dir="$containers_dir/libreportal/frontend/data/peers/generated"
+    local output_dir="$(webuiDir)/frontend/data/peers/generated"
     local output_file="$output_dir/peers.json"
 
     runFileOp mkdir -p "$output_dir"
diff --git a/scripts/webui/data/generators/system/webui_ssh_access.sh b/scripts/webui/data/generators/system/webui_ssh_access.sh
index b086ff9..85f709e 100644
--- a/scripts/webui/data/generators/system/webui_ssh_access.sh
+++ b/scripts/webui/data/generators/system/webui_ssh_access.sh
@@ -6,7 +6,7 @@
 
 webuiGenerateSshAccess()
 {
-    local out_dir="$containers_dir/libreportal/frontend/data/ssh"
+    local out_dir="$(webuiDir)/frontend/data/ssh"
     local out_file="$out_dir/access.json"
     runFileOp mkdir -p "$out_dir"
 
diff --git a/scripts/webui/data/generators/system/webui_system_disk.sh b/scripts/webui/data/generators/system/webui_system_disk.sh
index e83d1d4..c2b8f34 100755
--- a/scripts/webui/data/generators/system/webui_system_disk.sh
+++ b/scripts/webui/data/generators/system/webui_system_disk.sh
@@ -27,7 +27,7 @@ webuiSystemDisk() {
     fi
     
     # Create system info directory if it doesn't exist
-    local system_dir="$containers_dir/libreportal/frontend/data/system"
+    local system_dir="$(webuiDir)/frontend/data/system"
     createFolders "quiet" $sudo_user_name "$system_dir"
     
     # Create temp file first, then atomic move
diff --git a/scripts/webui/data/generators/system/webui_system_health.sh b/scripts/webui/data/generators/system/webui_system_health.sh
index bae4e28..e69db59 100644
--- a/scripts/webui/data/generators/system/webui_system_health.sh
+++ b/scripts/webui/data/generators/system/webui_system_health.sh
@@ -20,7 +20,7 @@
 webuiSystemHealthCheck() {
     local force_flag="$1"
 
-    local system_dir="$containers_dir/libreportal/frontend/data/system"
+    local system_dir="$(webuiDir)/frontend/data/system"
     local final_file="${system_dir}/health_status.json"
     local stamp_file="${system_dir}/.health_check_stamp"
     local heal_stamp="${system_dir}/.health_heal_stamp"
diff --git a/scripts/webui/data/generators/system/webui_system_info.sh b/scripts/webui/data/generators/system/webui_system_info.sh
index 8ec9c42..4ded246 100755
--- a/scripts/webui/data/generators/system/webui_system_info.sh
+++ b/scripts/webui/data/generators/system/webui_system_info.sh
@@ -31,7 +31,7 @@ webuiSystemInfo() {
     local kernel_version=$(uname -r)
     
     # Create system info directory if it doesn't exist
-    local system_dir="$containers_dir/libreportal/frontend/data/system"
+    local system_dir="$(webuiDir)/frontend/data/system"
     createFolders "quiet" $sudo_user_name "$system_dir"
     
     # Create temp file first, then atomic move
diff --git a/scripts/webui/data/generators/system/webui_system_memory.sh b/scripts/webui/data/generators/system/webui_system_memory.sh
index b3f4f9b..03f6c1a 100755
--- a/scripts/webui/data/generators/system/webui_system_memory.sh
+++ b/scripts/webui/data/generators/system/webui_system_memory.sh
@@ -23,7 +23,7 @@ webuiSystemMemory() {
     local mem_text="$mem_used_gb GB / $mem_total_gb GB - $mem_percent%"
     
     # Create system info directory if it doesn't exist
-    local system_dir="${containers_dir}libreportal/frontend/data/system"
+    local system_dir="$(webuiDir)/frontend/data/system"
     createFolders "quiet" $sudo_user_name "$system_dir"
     
     # Create temp file first, then atomic move
diff --git a/scripts/webui/data/generators/system/webui_system_metrics.sh b/scripts/webui/data/generators/system/webui_system_metrics.sh
index 598de5e..c6ea7cc 100644
--- a/scripts/webui/data/generators/system/webui_system_metrics.sh
+++ b/scripts/webui/data/generators/system/webui_system_metrics.sh
@@ -27,7 +27,7 @@ _metricsReadCpu() {
 }
 
 webuiSystemMetrics() {
-    local system_dir="${containers_dir}libreportal/frontend/data/system"
+    local system_dir="$(webuiDir)/frontend/data/system"
     createFolders "quiet" "$sudo_user_name" "$system_dir"
 
     local now_epoch; now_epoch=$(date +%s)
@@ -209,7 +209,7 @@ EOF
 # run per CFG_APP_STORAGE_INTERVAL (default 10 min) via the .stamp idiom used by
 # the update/verify checks above. Pass "force" to bypass it.
 webuiSystemAppStorage() {
-    local system_dir="${containers_dir}libreportal/frontend/data/system"
+    local system_dir="$(webuiDir)/frontend/data/system"
     createFolders "quiet" "$sudo_user_name" "$system_dir"
 
     local final_file="$system_dir/app_storage.json"
@@ -304,7 +304,7 @@ webuiSystemAppStorage() {
 # compose project label fall back to their container name so nothing is lost.
 webuiSystemApps() {
     local now_epoch="$1" now_iso="$2" system_dir="$3"
-    [[ -z "$system_dir" ]] && system_dir="${containers_dir}libreportal/frontend/data/system"
+    [[ -z "$system_dir" ]] && system_dir="$(webuiDir)/frontend/data/system"
     command -v docker &>/dev/null || return 0
 
     # name|project|state|status  for every container (running or not)
diff --git a/scripts/webui/data/generators/system/webui_system_network.sh b/scripts/webui/data/generators/system/webui_system_network.sh
index 056a7f5..b675df5 100644
--- a/scripts/webui/data/generators/system/webui_system_network.sh
+++ b/scripts/webui/data/generators/system/webui_system_network.sh
@@ -16,7 +16,7 @@
 webuiSystemNetworkCheck() {
     local force_flag="$1"
 
-    local system_dir="$containers_dir/libreportal/frontend/data/system"
+    local system_dir="$(webuiDir)/frontend/data/system"
     local final_file="${system_dir}/network_status.json"
     local stamp_file="${system_dir}/.network_check_stamp"
     local interval="${CFG_NETWORK_CHECK_INTERVAL:-300}"
diff --git a/scripts/webui/data/generators/system/webui_system_update.sh b/scripts/webui/data/generators/system/webui_system_update.sh
index 5ab2705..c73f733 100755
--- a/scripts/webui/data/generators/system/webui_system_update.sh
+++ b/scripts/webui/data/generators/system/webui_system_update.sh
@@ -52,7 +52,7 @@ webuiSystemUpdateCheck() {
     local force_flag="$1"
 
     local repo_dir="${script_dir}"
-    local system_dir="$containers_dir/libreportal/frontend/data/system"
+    local system_dir="$(webuiDir)/frontend/data/system"
     local final_file="${system_dir}/update_status.json"
     local stamp_file="${system_dir}/.update_check_stamp"
     # How long (seconds) a fetch result stays "fresh" before we hit the network
@@ -267,7 +267,7 @@ EOF
 webuiSystemVerify() {
     local force_flag="$1"
 
-    local system_dir="$containers_dir/libreportal/frontend/data/system"
+    local system_dir="$(webuiDir)/frontend/data/system"
     local final_file="${system_dir}/verify_status.json"
     local stamp_file="${system_dir}/.verify_check_stamp"
     local interval="${CFG_VERIFY_CHECK_INTERVAL:-86400}"
diff --git a/scripts/webui/data/generators/updater/webui_updater_scan.sh b/scripts/webui/data/generators/updater/webui_updater_scan.sh
index 3b760e1..a189b1a 100644
--- a/scripts/webui/data/generators/updater/webui_updater_scan.sh
+++ b/scripts/webui/data/generators/updater/webui_updater_scan.sh
@@ -355,7 +355,7 @@ updaterDisplayVersion() {
 }
 
 webuiUpdaterScan() {
-    local out_dir="$containers_dir/libreportal/frontend/data/updater/generated"
+    local out_dir="$(webuiDir)/frontend/data/updater/generated"
     runFileOp mkdir -p "$out_dir" 2>/dev/null || mkdir -p "$out_dir" 2>/dev/null
 
     local now; now="$(date -Iseconds 2>/dev/null || date)"
diff --git a/scripts/webui/data/lock/webui_check_update_lock.sh b/scripts/webui/data/lock/webui_check_update_lock.sh
index 9ffb4f2..e7360eb 100755
--- a/scripts/webui/data/lock/webui_check_update_lock.sh
+++ b/scripts/webui/data/lock/webui_check_update_lock.sh
@@ -15,7 +15,7 @@
 # the leftover lock would otherwise wedge EVERY future refresh. No single refresh
 # runs anywhere near this long, so a lock older than the threshold is a leftover.
 webuiCheckUpdateLock() {
-    local lock_file="$containers_dir/libreportal/frontend/data/updater.lock"
+    local lock_file="$(webuiDir)/frontend/data/updater.lock"
     local stale_after=900   # seconds (15 min); far longer than any real refresh
 
     if [ ! -f "$lock_file" ]; then
diff --git a/scripts/webui/data/lock/webui_create_update_lock.sh b/scripts/webui/data/lock/webui_create_update_lock.sh
index 2fa536b..2f892c5 100755
--- a/scripts/webui/data/lock/webui_create_update_lock.sh
+++ b/scripts/webui/data/lock/webui_create_update_lock.sh
@@ -4,7 +4,7 @@
 # Creates update lock file to prevent concurrent updates
 
 webuiCreateUpdateLock() {
-    local lock_file="$containers_dir/libreportal/frontend/data/updater.lock"
+    local lock_file="$(webuiDir)/frontend/data/updater.lock"
     
     # Create lock file with timestamp and process ID. The lock lives in the
     # dockerinstall-owned WebUI data dir, so write it as the path owner.
diff --git a/scripts/webui/data/lock/webui_remove_setup_lock.sh b/scripts/webui/data/lock/webui_remove_setup_lock.sh
index 983cf88..b961380 100755
--- a/scripts/webui/data/lock/webui_remove_setup_lock.sh
+++ b/scripts/webui/data/lock/webui_remove_setup_lock.sh
@@ -4,7 +4,7 @@
 # Removes setup lock file after update completion
 
 webuiRemoveSetupLock() {
-    local lock_file="$containers_dir/libreportal/frontend/data/setup.lock"
+    local lock_file="$(webuiDir)/frontend/data/setup.lock"
     
     if [ -f "$lock_file" ]; then
         runFileOp rm -f "$lock_file"
diff --git a/scripts/webui/data/lock/webui_remove_update_lock.sh b/scripts/webui/data/lock/webui_remove_update_lock.sh
index 8e1b1a9..579487d 100755
--- a/scripts/webui/data/lock/webui_remove_update_lock.sh
+++ b/scripts/webui/data/lock/webui_remove_update_lock.sh
@@ -4,7 +4,7 @@
 # Removes update lock file after update completion
 
 webuiRemoveUpdateLock() {
-    local lock_file="$containers_dir/libreportal/frontend/data/updater.lock"
+    local lock_file="$(webuiDir)/frontend/data/updater.lock"
     
     if [ -f "$lock_file" ]; then
         runFileOp rm -f "$lock_file"
diff --git a/scripts/webui/data/logs/webui_logs_folders.sh b/scripts/webui/data/logs/webui_logs_folders.sh
index 8cda4c1..dff4983 100755
--- a/scripts/webui/data/logs/webui_logs_folders.sh
+++ b/scripts/webui/data/logs/webui_logs_folders.sh
@@ -4,7 +4,7 @@
 
 webuiCreateLogsFolders() 
 {
-    local log_dir="${containers_dir}libreportal/frontend/logs"
+    local log_dir="$(webuiDir)/frontend/logs"
     local apps_dir="${log_dir}/apps"
     if [ ! -d "$apps_dir" ]; then
         local result; result=$(createFolders "loud" $sudo_user_name $log_dir $apps_dir)
diff --git a/scripts/webui/data/tasks/webui_task_files.sh b/scripts/webui/data/tasks/webui_task_files.sh
index bf3f7c1..33bc6ed 100755
--- a/scripts/webui/data/tasks/webui_task_files.sh
+++ b/scripts/webui/data/tasks/webui_task_files.sh
@@ -4,7 +4,7 @@
 # Ensures essential task system files exist for LibrePortal task management
 
 webuiEnsureTaskFiles() {
-    local task_dir="${containers_dir}libreportal/frontend/data/tasks"
+    local task_dir="$(webuiDir)/frontend/data/tasks"
     
     # Create tasks directory if it doesn't exist
     if [ ! -d "$task_dir" ]; then
diff --git a/scripts/webui/data/utils/webui_app_icons.sh b/scripts/webui/data/utils/webui_app_icons.sh
index b64ebc9..33e8914 100755
--- a/scripts/webui/data/utils/webui_app_icons.sh
+++ b/scripts/webui/data/utils/webui_app_icons.sh
@@ -13,7 +13,7 @@ webuiSyncAppIcon() {
     local app_name="$1"
     [[ -z "$app_name" ]] && return 1
 
-    local icons_dir="${containers_dir}libreportal/frontend/core/icons/apps"
+    local icons_dir="$(webuiDir)/frontend/core/icons/apps"
     runFileOp mkdir -p "$icons_dir"
 
     # Icons live in the install template dir — copy_build_context.sh
@@ -65,7 +65,7 @@ webuiSyncAppIcons() {
 # Only ever removes icons it can match to a missing template, never anything
 # else in the directory.
 webuiPruneAppIcons() {
-    local icons_dir="${containers_dir}libreportal/frontend/core/icons/apps"
+    local icons_dir="$(webuiDir)/frontend/core/icons/apps"
     [[ -d "$icons_dir" ]] || return 0
     [[ -d "$install_containers_dir" ]] || return 0
 
diff --git a/scripts/webui/data/utils/webui_app_log.sh b/scripts/webui/data/utils/webui_app_log.sh
index c1cc8e7..5efcdf6 100755
--- a/scripts/webui/data/utils/webui_app_log.sh
+++ b/scripts/webui/data/utils/webui_app_log.sh
@@ -6,7 +6,7 @@ webuiUpdateAppLog()
     local type=$2 # install or uninstall
 
     # Create logs directory if it doesn't exist
-    local log_dir="${containers_dir}libreportal/frontend/logs"
+    local log_dir="$(webuiDir)/frontend/logs"
     local apps_dir="${log_dir}/apps"
     if [ ! -d "$apps_dir" ]; then
         local result; result=$(createFolders "loud" $sudo_user_name $log_dir $apps_dir)
diff --git a/scripts/webui/data/utils/webui_atomic_write.sh b/scripts/webui/data/utils/webui_atomic_write.sh
index a070a56..0b1b3ca 100755
--- a/scripts/webui/data/utils/webui_atomic_write.sh
+++ b/scripts/webui/data/utils/webui_atomic_write.sh
@@ -13,7 +13,7 @@ atomicWriteWebUI() {
     # can write the dockerinstall-owned WebUI/app files. Temp + rename share the
     # target's directory, so the mv stays atomic (same filesystem, same owner).
     local op="runInstallOp" wop="runInstallWrite"
-    if [[ "$target_file" == "$containers_dir"* || "$target_file" == "${LP_CONTAINERS_DIR:-/libreportal-containers}"/* ]]; then
+    if pathIsContainerData "$target_file"; then
         op="runFileOp"; wop="runFileWrite"
     fi
 
diff --git a/scripts/webui/webui_install_image.sh b/scripts/webui/webui_install_image.sh
index eef741d..5f1aacb 100755
--- a/scripts/webui/webui_install_image.sh
+++ b/scripts/webui/webui_install_image.sh
@@ -17,7 +17,7 @@ installLibrePortalImageWebUI()
   # libreportal.config as a Docker-created directory. The tar copy below can't
   # extract a file over a directory ("Cannot open: File exists") and aborts the
   # whole source copy, so clear the stub first.
-  repairStubDirForFile "$containers_dir/libreportal/libreportal.config" "loud"
+  repairStubDirForFile "$(webuiDir)/libreportal.config" "loud"
 
   local result; result=$(copyFolder "$install_containers_dir/libreportal" "$containers_dir" "$sudo_user_name")
   checkSuccess "Copy the LibrePortal to the containers folder"
@@ -40,6 +40,6 @@ installLibrePortalImageWebUI()
   fi
 
   isNotice "Building libreportal-service image, this may take a while..."
-  local result; result=$(runFileOp docker build -t libreportal-service -f $containers_dir/libreportal/Dockerfile $containers_dir/libreportal >/dev/null 2>&1)
+  local result; result=$(runFileOp docker build -t libreportal-service -f $(webuiDir)/Dockerfile $(webuiDir) >/dev/null 2>&1)
   checkSuccess "Built LibrePortal WebUI Docker image"
 }
\ No newline at end of file
diff --git a/scripts/webui/webui_install_systemd.sh b/scripts/webui/webui_install_systemd.sh
index e213359..f21b380 100755
--- a/scripts/webui/webui_install_systemd.sh
+++ b/scripts/webui/webui_install_systemd.sh
@@ -14,7 +14,7 @@ installLibrePortalWebUITaskService()
   [[ "$CFG_REQUIREMENT_WEBUI_SERVICE" == "true" ]] || return 0
 
   local task_processor_script="$install_scripts_dir/task/crontab_task_processor.sh"
-  local task_dir="$containers_dir/libreportal/frontend/data/tasks"
+  local task_dir="$(webuiDir)/frontend/data/tasks"
 
   # Point the processor at the task dir (idempotent). This edits the
   # manager-owned install tree, so no privilege is needed.
diff --git a/scripts/webui/webui_regen.sh b/scripts/webui/webui_regen.sh
index 4ba3851..ea78539 100644
--- a/scripts/webui/webui_regen.sh
+++ b/scripts/webui/webui_regen.sh
@@ -49,7 +49,7 @@ _lpRegenOrphanedApp() {
 
 lpRegenWebui() {
     local force="$1"
-    local gen="${containers_dir}libreportal/frontend/data/apps/generated"
+    local gen="$(webuiDir)/frontend/data/apps/generated"
     local apps_json="$gen/apps.json"
     local tools_json="$gen/apps-tools.json"
 
diff --git a/scripts/webui/webui_updater.sh b/scripts/webui/webui_updater.sh
index 4c5626a..b8bb830 100755
--- a/scripts/webui/webui_updater.sh
+++ b/scripts/webui/webui_updater.sh
@@ -59,7 +59,7 @@ webuiLibrePortalUpdate() {
             checkSuccess "Generated system configurations..."
 
             # Generate categories
-            local result; result=$(webuiCreateCategories $containers_dir/libreportal/frontend/data)
+            local result; result=$(webuiCreateCategories $(webuiDir)/frontend/data)
             checkSuccess "Generated app and config categories..."
 
             # Generate LibrePortal app configuration