diff --git a/scripts/network/firewall/rules/firewall_rebuild_from_db.sh b/scripts/network/firewall/rules/firewall_rebuild_from_db.sh
index beaefe7..9270c4f 100755
--- a/scripts/network/firewall/rules/firewall_rebuild_from_db.sh
+++ b/scripts/network/firewall/rules/firewall_rebuild_from_db.sh
@@ -9,7 +9,7 @@ firewallRebuildFromDatabase()
     
     # Determine firewall type
     local firewall_type=""
-    if [[ $EUID -eq 0 ]] && command -v ufw-docker &> /dev/null; then
+    if [[ "$CFG_DOCKER_INSTALL_TYPE" == "rooted" ]] && command -v ufw-docker &> /dev/null; then
         firewall_type="ufw-docker"
         isSuccessful "Using UFW-Docker for Rooted install"
     elif command -v ufw &> /dev/null; then
@@ -21,7 +21,7 @@ firewallRebuildFromDatabase()
     
     # Check if Traefik is installed and running
     local traefik_available=false
-    if [[ -d "$containers_dir/traefik" ]] && docker ps --format "table {{.Names}}" | grep -q "traefik"; then
+    if [[ -d "$containers_dir/traefik" ]] && runFileOp docker ps --format "table {{.Names}}" | grep -q "traefik"; then
         traefik_available=true
         isSuccessful "Traefik detected - respecting traefik_managed flags"
     else
@@ -95,11 +95,11 @@ firewallRebuildFromDatabase()
                         # the published port", so no route rule is created and
                         # the container is unreachable from other hosts — host
                         # access still works via docker-proxy, which masks it.
-                        result=$(sudo ufw-docker allow "$app_name" "${port_internal:-$port_value}/tcp" 2>&1)
+                        result=$(runSystem ufw-docker allow "${service_name:-$app_name}" "${port_internal:-$port_value}/tcp" 2>&1)
                     else
                         # Rootless: container ports are published on the host,
                         # so the external port is the one to open.
-                        result=$(sudo ufw allow "$port_spec" comment "LibrePortal" 2>&1)
+                        result=$(runSystem ufw allow "$port_spec" comment "LibrePortal" 2>&1)
                     fi
                     # Capture rc separately: `local x=$(...)` would clobber $?
                     # with the exit of `local`, hiding the command's real status.