chown should be done in entrypoint.sh