Same root-owned-bind-mount issue as /certs: the non-root proxy couldn't
write netbird state ('failed to write active profile state / geolocation:
permission denied'). Use a named volume for /var/lib/netbird as well.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>