Save files using LDAP uid in Docker container

Describe the solution you'd like

I have a Docker pgadmin running on an internal server, using LDAP for user authentication, and a custom STORAGE_DIR bind mounted outside the container. I would like users to be able to save files with sensible ownership and/or permissions so they can access the files they save from pgadmin. Optimally, a user logged in via LDAP should have a storage subdirectory owned by that user, and saved files also owned by that user, but is also workable to continue with files and directories owned by 5050 if the directory and file permissions worked (2775 for the user subdirectories and 664 for the files, respecting the top level group ownership).

Describe alternatives you've considered

I have a custom STORAGE_DIR and a bind mount so users can access the files they save from outside the container. I've updated the group on this location to a group all users are part of (Domain Users) and changed the permission on the directory to 2775, which results in the user-level subdirectories also being members of the upper level group. Unfortunately, the user directories under the storage directory get drwx--S--- permissions with 5050:Domain Users ownership. When files are saved into the directory, the permissions are -rw-r--r-- to 5050:Domain Users. That means users can read their files, but they can't delete them or otherwise manipulate them.

I tried manually changing the permissions on the user subdirectory to 2775 (drwxrwsr-x), but files subsequently written are still -rw-r--r-- to 5050:Domain Users. This sounds like a umask issue, but I don't know how I might change that.

Additional context

Latest (as of 2022-12-29) image dpage/pgadmin4.

$ docker inspect 4d5afde0a02e
[
    {
        "Id": "sha256:4d5afde0a02ec3d9ede87df8825d82f76eb85ff127adc2b6976c379e6eb91bc9",
        "RepoTags": [
            "dpage/pgadmin4:latest"
        ],
        "RepoDigests": [
            "dpage/pgadmin4@sha256:f5cdc53122327f5f76f42dec3ab80f8608ac160e0d393d8e21be4fcb7e6cfaf0"
        ],
        "Parent": "",
        "Comment": "",
        "Created": "2022-12-14T10:49:48.636923261Z",
        "Container": "e7f4c1412f4b91629373bd46722fbfcd4620e9c50b91cabdf58304726f70d938",
        "ContainerConfig": {
            "Hostname": "e7f4c1412f4b",
            "Domainname": "",
            "User": "pgadmin",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "ExposedPorts": {
                "443/tcp": {},
                "80/tcp": {}
            },
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "PYTHONPATH=/pgadmin4"
            ],
            "Cmd": [
                "/bin/sh",
                "-c",
                "#(nop) ",
                "ENTRYPOINT [\"/entrypoint.sh\"]"
            ],
            "Image": "sha256:61b967a3380f706c8257590f15d5947f231a69c936ff9121b535f2f36c2ebd25",
            "Volumes": {
                "/var/lib/pgadmin": {}
            },
            "WorkingDir": "/pgadmin4",
            "Entrypoint": [
                "/entrypoint.sh"
            ],
            "OnBuild": null,
            "Labels": {}
        },
        "DockerVersion": "20.10.16",
        "Author": "",
        "Config": {
            "Hostname": "",
            "Domainname": "",
            "User": "pgadmin",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "ExposedPorts": {
                "443/tcp": {},
                "80/tcp": {}
            },
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "PYTHONPATH=/pgadmin4"
            ],
            "Cmd": null,
            "Image": "sha256:61b967a3380f706c8257590f15d5947f231a69c936ff9121b535f2f36c2ebd25",
            "Volumes": {
                "/var/lib/pgadmin": {}
            },
            "WorkingDir": "/pgadmin4",
            "Entrypoint": [
                "/entrypoint.sh"
            ],
            "OnBuild": null,
            "Labels": null
        },
        "Architecture": "amd64",
        "Os": "linux",
        "Size": 361269653,
        "VirtualSize": 361269653,
        "GraphDriver": {
            "Data": {
                "LowerDir": "/var/lib/docker/overlay2/658fecc717a1c556fa27560ac8bfa1db786042100ea95d923650e77bf5eb3c97/diff:/var/lib/docker/overlay2/cde866214b4cd813245f6f99852d31dd8d7988c67f721a37f666e8dbe8e93c0c/diff:/var/lib/docker/overlay2/233e56904c500ab18c17f7330626a9227f4764c6de043be28123cdb5976204dd/diff:/var/lib/docker/overlay2/c52c1946715f608a5625c223ee322ea82eae4361edb204c846815ff5337de9be/diff:/var/lib/docker/overlay2/d2a1564c33941d5c24444682c7d407d51ef86af02e93f5e5be80ef2c57735e7d/diff:/var/lib/docker/overlay2/aee9fe030cd867f559dabc5af163074cb1a1f8bcd802255ebcd2a51a51b5f41e/diff:/var/lib/docker/overlay2/c60a71304764e630ef369cb66787f28726e484a87bbc555e8ba9340b1ee79ed1/diff:/var/lib/docker/overlay2/f47bbc5807d6d2ada543cb1c86dace8c0a481a2e7c0117762c1a72e600860642/diff:/var/lib/docker/overlay2/95f2c26c6b15fe2dc13856561502a9e6c1b57dde18ad8a72494971fc59e31d3d/diff:/var/lib/docker/overlay2/c22d34bac7a836471d5e52827277df054cd1d75f4dbd83a44d4e7bceddc046d8/diff:/var/lib/docker/overlay2/1259fe4c170206499caf67c4a932b711022d271891d9f191116e4615bc669921/diff:/var/lib/docker/overlay2/f03927911bfe232826d38d1174beef9099d150ae288cb76d390f48e351144891/diff:/var/lib/docker/overlay2/69ec0f14d4b64354fdaf984427ef0cf912edbe00ceab3a734557afa0ffa6ba02/diff",
                "MergedDir": "/var/lib/docker/overlay2/51b8ac15891c91128150e9ae1b373851b0a065555e601d9d319b292e2ff8c629/merged",
                "UpperDir": "/var/lib/docker/overlay2/51b8ac15891c91128150e9ae1b373851b0a065555e601d9d319b292e2ff8c629/diff",
                "WorkDir": "/var/lib/docker/overlay2/51b8ac15891c91128150e9ae1b373851b0a065555e601d9d319b292e2ff8c629/work"
            },
            "Name": "overlay2"
        },
        "RootFS": {
            "Type": "layers",
            "Layers": [
                "sha256:ded7a220bb058e28ee3254fbba04ca90b679070424424761a53a043b93b612bf",
                "sha256:89ce934e72a12b243691f2da4f27031124d4e7e400887a7273da6f629ba0608c",
                "sha256:4b004997be9f6ea7b3e4da7e0b4e8715020074b57dcafec649381eb3f48bdeec",
                "sha256:7d6017e6576f37f007c41056ada5813e3c452059d053ea95e898024e3e40fa02",
                "sha256:c0a4221bdbe89e98610cdeee59bdd2253f0f7adade55d4913290da96b54a7690",
                "sha256:f8572f15262dfc587870b7a2661cab804b3c10ecbad44ace0e02e63d06dbd4d8",
                "sha256:ba7cb5f36dae2e0ae9b5096f4ab726bb0c9bc8425773df4b9ac191d63bec8597",
                "sha256:f3c709a78a848b3077b4c4d72269147eeff99ac8d085dbdbaa8f8e5c4944338a",
                "sha256:76f23635ecfe1a483ba3da3ed9ec17f27321647784cece22e784bdc5896d0854",
                "sha256:393eba0f78d972f8777fc7c52eace520327ad126b46560fc09ac92c22e57deb2",
                "sha256:03c2b266e821e5e05b50fbf1be23b8e07ac6d5b1236c14507e55a02f675291e9",
                "sha256:4efff0815181c7fe6642d1a777495e27b3b2cbcd4775011c19e5f4abbc8a1fc4",
                "sha256:5cddb77f36cb1ebbd68c2afae212dc93408b299213d4452818f4077d74305747",
                "sha256:8580e94b9cc357b75d2d61f9b2ca35eff611336bceb2357a1cf7c065be607685"
            ]
        },
        "Metadata": {
            "LastTagTime": "0001-01-01T00:00:00Z"
        }
    }
]

Start with /entrypoint.sh and the STORAGE_DIR handling in the Docker image; inspect how the pgAdmin process creates user directories and files under the bind mount. Reproduce the LDAP-authenticated save flow with the reported 5050:Domain Users ownership and permissions, then define and verify the intended ownership and permission behavior.