observability: run as container root 0:0, not 1000:1000

Measured the rootless mapping: container root IS the invoking user
(dank, owner of the /opt data dirs); the images' default users (loki
10001, prometheus nobody, grafana 472) map to subuids that own nothing.
1000:1000 was the wrong direction.

dankclaw/compose.yaml

@@ -103,9 +103,10 @@ services:
     image: docker.io/prom/prometheus:latest
     container_name: prometheus
     restart: unless-stopped
-    # Rootless: container uid 1000 maps to the invoking user, so the
-    # container can write its /opt/prometheus/data bind mount.
-    user: "1000:1000"
+    # Rootless: container root maps to the invoking user (dank), which
+    # owns /opt/prometheus/data. The image's default user (nobody) maps to
+    # a subuid that cannot write it.
+    user: "0:0"
     command:
       - --config.file=/etc/prometheus/prometheus.yml
       - --storage.tsdb.path=/prometheus
@@ -126,9 +127,10 @@ services:
     image: docker.io/grafana/grafana:latest
     container_name: grafana
     restart: unless-stopped
-    # Rootless: container uid 1000 maps to the invoking user, so the
-    # container can write its /opt/grafana/data bind mount.
-    user: "1000:1000"
+    # Rootless: container root maps to the invoking user (dank), which
+    # owns /opt/grafana/data. The image's default user (472) maps to a
+    # subuid that cannot write it.
+    user: "0:0"
     environment:
       GF_SERVER_ROOT_URL: "https://grafana.franksdank.cloud"
       GF_SECURITY_ADMIN_USER: "${GRAFANA_ADMIN_USER}"
@@ -150,9 +152,10 @@ services:
     image: docker.io/grafana/loki:latest
     container_name: loki
     restart: unless-stopped
-    # Rootless: container uid 1000 maps to the invoking user, so the
-    # container can write its /opt/loki/data bind mount.
-    user: "1000:1000"
+    # Rootless: container root maps to the invoking user (dank), which
+    # owns /opt/loki/data. The image's default user (10001) maps to a
+    # subuid that cannot write it.
+    user: "0:0"
     command: ["-config.file=/etc/loki/loki-config.yaml"]
     ports:
       - "3100:3100"