diff --git a/Dockerfile b/Dockerfile
index f23cd7b074..8955bced06 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -89,6 +89,10 @@ RUN chown -R node:node /app
 
 EXPOSE 20128
 
+# Warns if the mounted data volume has wrong ownership
+COPY --chmod=755 scripts/check-permissions.sh /tmp/check-permissions.sh
+ENTRYPOINT ["/tmp/check-permissions.sh"]
+
 USER node
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
diff --git a/scripts/check-permissions.sh b/scripts/check-permissions.sh
new file mode 100755
index 0000000000..13eedf45b0
--- /dev/null
+++ b/scripts/check-permissions.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+set -e
+
+if [ -d "/app/data" ] && [ ! -w "/app/data" ]; then
+    echo "WARNING: /app/data is not writable by the current user (UID $(id -u))."
+    echo "Run this on the Docker host to fix:"
+    echo "  sudo chown -R 1000:1000 ./data"
+    echo "  chmod -R u+rwX ./data"
+    exit 1
+fi
+
+exec "$@"