diff --git a/.env.example b/.env.example
index d759239..ec957eb 100644
--- a/.env.example
+++ b/.env.example
@@ -30,12 +30,37 @@ INKNOTE_ADMIN_USER=
 INKNOTE_ADMIN_PASSWORD=
 
 # ── Where the data lives ──
-# A plain directory on the Docker host, so the host's own backup covers it.
-# Create it before the first start:
+# A plain directory on the Docker host — a bind mount, not a Docker volume, so
+# that whatever backs up the host also backs up InkNote. Create it first; the
+# container runs unprivileged and cannot create it for you:
+#
 #   mkdir -p /srv/inknote/{db,uploads} && chown -R 1000:1000 /srv/inknote
+#
 # INKNOTE_DATA_DIR=/srv/inknote     # dev compose defaults to ./data
 # INKNOTE_UID=1000                  # must own the directory above
 # INKNOTE_GID=1000
+#
+# The path must start with / or ./ — anything else Docker reads as the name of
+# a named volume, and a name containing a slash simply fails.
+#
+# ── Putting it under /root ──
+# /root is normally mode 0700, and uid 1000 cannot even pass through it, so the
+# server would fail to write however the directory itself is owned. Two ways
+# out; the first keeps the unprivileged container and is the better trade:
+#
+#   A) let uid 1000 traverse /root, without making it readable:
+#        mkdir -p /root/inknote/{db,uploads}
+#        chown -R 1000:1000 /root/inknote
+#        chmod o+x /root            # traverse only — ls /root still refused
+#        INKNOTE_DATA_DIR=/root/inknote
+#
+#   B) run the container as root instead — no chown, no chmod, but a break-out
+#      lands on root rather than on an unprivileged user:
+#        INKNOTE_DATA_DIR=/root/inknote
+#        INKNOTE_UID=0
+#        INKNOTE_GID=0
+#
+# Neither is needed under /srv or /opt, which is why those are the default.
 
 # ── Optional tuning ──
 # Leave unset to keep the defaults shown.