flowchart TB
  subgraph build["Building the image"]
    user["USER 20500:20500"]
    chown["chown at build time<br/>or COPY --chown"]
  end
  subgraph image["Shipped image"]
    decl["Declaration<br/>Config.User"]
    proprio[("File owner<br/>baked into the layers")]
  end
  subgraph exec["Run time"]
    q{"does docker run<br/>pass --user ?"}
    impose["uid from the<br/>command line"]
    herite["uid declared<br/>by the image"]:::accent
  end
  ecrit["The application writes"]:::accent
  refus["Permission denied"]:::danger
  user ==> decl
  chown ==> proprio
  decl ==> q
  q ==>|no| herite
  q -.->|yes| impose
  proprio ==> ecrit
  herite ==> ecrit
  impose -.-> ecrit
  decl -.->|owner left as root| refus