A container that writes files the host cannot delete

A bind mount passes numeric uids straight through, so a container running as uid 1000 writes files owned by whatever uid 1000 is on the host.

$ docker compose exec php php artisan cache:clear
$ ls -l storage/framework/cache
drwxr-xr-x 2 82 82 4096 Mar 14 09:41 data

# uid 82 is www-data in alpine, and nothing on the host.
$ rm -rf storage/framework/cache/data
rm: cannot remove: Permission denied

# and on macOS none of this happens, because the
# virtualisation layer rewrites ownership — which is why
# it is always Linux users who report it.

The macOS exception is why this reaches a team late: the person who wrote the compose file never saw it, and the first Linux developer to join spends an afternoon on it. The fix is either matching the uid at build time or keeping the directory in a named volume, and choosing depends on whether the host ever needs to read the files.