Resolve "[Docker] Do not run as root"

Closes #409 (closed)

This MR also partially addresses #403 (closed) because fixing the permissions on the data required touching the volumes anyway. But it is not complete — especially, the static root should not be writable by www-data.