diff --git a/write-server/Dockerfile b/write-server/Dockerfile
index a7e29721..6c69432e 100644
--- a/write-server/Dockerfile
+++ b/write-server/Dockerfile
@@ -32,8 +32,8 @@ RUN npm run build
 FROM node:20-alpine AS runner
 WORKDIR /app
 
-# Install Hugo
-RUN apk add --no-cache hugo
+# Install Hugo and su-exec (for entrypoint)
+RUN apk add --no-cache hugo su-exec
 
 # Create non-root user
 RUN addgroup --system --gid 1001 nodejs && \
@@ -47,12 +47,12 @@ COPY --from=builder /app/.next/static ./.next/static
 # Copy package.json for version info
 COPY --from=builder /app/package.json ./
 
-# Create necessary directories
-RUN mkdir -p /app/logs /app/backups && \
-    chown -R nextjs:nodejs /app
+# Copy entrypoint script
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
 
-# Switch to non-root user
-USER nextjs
+# Create necessary directories
+RUN mkdir -p /app/logs /app/backups /app/recycle/posts /app/recycle/meta
 
 # Expose port
 EXPOSE 8016
@@ -66,5 +66,6 @@ ENV HOSTNAME="0.0.0.0"
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
     CMD wget --no-verbose --tries=1 --spider http://localhost:8016/api/stats || exit 1
 
-# Start application
+# Start application via entrypoint (fixes permissions, drops to nextjs)
+ENTRYPOINT ["/entrypoint.sh"]
 CMD ["node", "server.js"]
diff --git a/write-server/entrypoint.sh b/write-server/entrypoint.sh
new file mode 100644
index 00000000..d7290494
--- /dev/null
+++ b/write-server/entrypoint.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+# Docker entrypoint script
+# 修复挂载目录权限后以 nextjs 用户启动应用
+
+# 创建必要的子目录（以 root 身份）
+mkdir -p /app/recycle/posts /app/recycle/meta /app/logs /app/backups
+
+# 修复权限
+chown -R nextjs:nodejs /app/recycle /app/logs /app/backups
+
+# 以 nextjs 用户启动应用
+exec su-exec nextjs "$@"