The image now runs as USER 10001:10001 with a matching group, so Kubernetes can verify runAsNonRoot and fsGroup: 10001 grants it a mounted volume. When the database can't be opened because its directory isn't writable, the server says so and how to fix it, instead of SQLite's bare "unable to open database file". The README covers the pod securityContext.