diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile
index 773adfc..3b882cb 100644
--- a/apps/api/Dockerfile
+++ b/apps/api/Dockerfile
@@ -54,8 +54,10 @@ RUN mkdir -p /data/repos /data/instances && chown -R appuser:appgroup /data
 COPY wait-for-db.sh /usr/local/bin/wait-for-db.sh
 RUN chmod +x /usr/local/bin/wait-for-db.sh
 
-# Switch to non-root user
-USER appuser
+# NOTE: Running as root to access Docker socket for managing tool instances
+# This is required because Docker socket permissions require root or docker group membership
+# which doesn't work well across container boundaries.
+# Consider using Docker-in-Docker or rootless Docker for production hardening.
 
 # Expose port
 EXPOSE 8000
diff --git a/docker-compose.traefik.yml b/docker-compose.traefik.yml
index 8b5a7a7..96f27d3 100644
--- a/docker-compose.traefik.yml
+++ b/docker-compose.traefik.yml
@@ -102,8 +102,6 @@ services:
       - avatar_uploads:/app/uploads
       - /var/run/docker.sock:/var/run/docker.sock
       - cloudflared_config:/etc/cloudflared
-    group_add:
-      - ${DOCKER_GID:-999}
     depends_on:
       postgres:
         condition: service_healthy