diff --git a/scripts/function/folder/copy_folder.sh b/scripts/function/folder/copy_folder.sh
index a95d4a0..0683bef 100755
--- a/scripts/function/folder/copy_folder.sh
+++ b/scripts/function/folder/copy_folder.sh
@@ -8,9 +8,23 @@ copyFolder()
     local user_name="$3"   # advisory — the destination path determines the owner
 
     # Write as the destination's owner — no root, no chown (see copyFile).
-    local op="runInstallOp"
-    [[ "$save_dir" == "$containers_dir"* || "$save_dir" == /docker/containers/* ]] && op="runFileOp"
-
-    local result=$($op cp -rf "$folder" "$save_dir")
+    if [[ "$save_dir" == "$containers_dir"* || "$save_dir" == /docker/containers/* ]]; then
+        if [[ "$folder" == "$containers_dir"* || "$folder" == /docker/containers/* ]]; then
+            # container -> container: same owner (dockerinstall), a plain cp works.
+            local result=$(runFileOp cp -rf "$folder" "$save_dir")
+        else
+            # Cross-owner: a manager-owned source (e.g. the install dir) into the
+            # container-owned destination. Under rootless a single cp can't read
+            # one end and write the other, so bridge with a tar pipe — the manager
+            # reads the source, dockerinstall writes the destination. No root, no
+            # chown; files land owned by the destination user. pipefail so a
+            # read-side failure isn't masked by a "successful" empty extract.
+            ( set -o pipefail
+              runInstallOp tar -C "$(dirname "$folder")" -cf - "$folder_name" \
+                | runFileOp tar -C "$save_dir" -xf - )
+        fi
+    else
+        local result=$(runInstallOp cp -rf "$folder" "$save_dir")
+    fi
     checkSuccess "Copying $folder_name to $save_dir"
 }
diff --git a/start.sh b/start.sh
index 61eda11..def88ba 100755
--- a/start.sh
+++ b/start.sh
@@ -49,6 +49,11 @@ initLibrePortal()
             install_log_path="/docker/logs/install-$(date +%Y%m%d-%H%M%S).log"
             sudo mkdir -p /docker/logs 2>/dev/null
             sudo touch "$install_log_path" 2>/dev/null
+            # Own it by whoever runs the install (the manager under Model A) so the
+            # tee below — which runs as that user, not root — can append. A
+            # sudo-touched file is root:root 644, leaving the manager unable to
+            # write it → the empty install-*.log files.
+            sudo chown "$(id -un):$(id -gn)" "$install_log_path" 2>/dev/null
             sudo chmod 644 "$install_log_path" 2>/dev/null
             export install_log_path
             exec > >(tee -a "$install_log_path") 2>&1