diff --git a/containers/vikunja/docker-compose.yml b/containers/vikunja/docker-compose.yml
index 0d66cd2..da942f5 100644
--- a/containers/vikunja/docker-compose.yml
+++ b/containers/vikunja/docker-compose.yml
@@ -9,14 +9,23 @@ services:
     vikunja-service: #LIBREPORTAL|SERVICE_TAG_1|vikunja-service
         container_name: vikunja-service
         image: vikunja/vikunja:latest #LIBREPORTAL|VIKUNJA_VERSION_TAG|latest
+        # The image runs as uid 1000, which under rootless Docker maps to a host
+        # sub-UID that owns nothing — Vikunja then dies on its first write to
+        # /app/vikunja/files and restarts forever. USER_TAG resolves to the
+        # identity that actually owns the bind mounts: 0:0 under rootless
+        # (container root == the install user on the host), the real uid:gid
+        # under rooted.
+        user: "USER_DATA" #LIBREPORTAL|USER_TAG|USER_DATA
         restart: unless-stopped
         hostname: vikunja
         # GLUETUN_OFF_BEGIN
         ports:
             - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
         # GLUETUN_OFF_END
+        # Deliberately NO docker socket mount: Vikunja is a task app and has no
+        # reason to talk to the daemon. Handing it the socket would be
+        # root-equivalent access on the host for no benefit.
         volumes:
-            - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
             # The image presets VIKUNJA_DATABASE_PATH=/db/vikunja.db, so the
             # database lives in /db and uploaded attachments in files/.
             - ./db:/db