The node-local matomo_tmp volume populated as root on any node that had not run the first-install entrypoint: the matomo image ships /var/www/html empty (code lives in /usr/src), and the entrypoint's chown -R www-data runs only when matomo.php is absent, which on a rescheduled task is never the case because matomo_data is shared NFS. The rescheduled task then died on 'tmp/cache/tracker could not be created', pausing every forced service update. Build a custom image whose /var/www/html/tmp is www-data-owned: docker volume populate replicates the image path's ownership into every fresh volume on every node (proven via moby populateVolume/CopyDir and a local reproduction), so reschedules get a writable tmp deterministically.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 4.8