diff --git a/infra/prod/Dockerfile b/infra/prod/Dockerfile
index 30c6244..c21262f 100644
--- a/infra/prod/Dockerfile
+++ b/infra/prod/Dockerfile
@@ -71,10 +71,14 @@ COPY --from=frontend-build /app/frontend/.output/public /var/www/html/frontend/.
 # Symfony needs a .env file to boot (variables are overridden by env_file in docker-compose)
 RUN echo "APP_ENV=prod" > /var/www/html/.env
 
-# Permissions
-RUN mkdir -p /var/www/html/var /var/www/html/var/uploads \
-    /var/www/maintenance/sirh /var/www/maintenance/lesstime /var/www/maintenance/inventory \
-    && chown -R www-data:www-data /var/www/html/var /var/www/maintenance
+# Permissions + directories
+RUN mkdir -p /var/www/html/var/log /var/www/html/var/uploads \
+    && chown -R www-data:www-data /var/www/html/var
+
+# Allow www-data to use Docker socket
+# The socket GID varies per host; we set it at container startup via entrypoint
+# As fallback, install docker group with common GID
+RUN groupadd -g 999 docker 2>/dev/null; usermod -aG docker www-data
 
 WORKDIR /var/www/html
 EXPOSE 80