WP-CLI in a container, and the user it runs as

Running WP-CLI as root inside a container works, and every file it writes is then owned by root and unwritable by the web process.

# what breaks it
docker compose exec php wp plugin install some-plugin
# → wp-content/plugins/some-plugin owned by root
# → the next update from the admin fails silently

# what to run instead
docker compose exec -u www-data php wp plugin install some-plugin

# and the alias that stops anybody forgetting
alias dwp='docker compose exec -u www-data php wp'

--allow-root makes the warning go away and does not make the ownership right, which is why the flag is the wrong reflex. Setting the user in the compose service definition rather than on each command is better still; where that is awkward, a shell alias committed to the repository documentation is the cheapest thing that works.