diff --git a/.dockerignore b/.dockerignore
index 7c77572..31c7117 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -13,3 +13,4 @@ Dockerfile
 docker-compose*.yml
 makefile
 # .env TIDAK diignore: NEXT_PUBLIC_* di-inline saat build
+data
diff --git a/Dockerfile b/Dockerfile
index 8e2aeb0..bba6895 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -25,6 +25,8 @@ RUN addgroup -S nodejs -g 1001 && adduser -S nextjs -u 1001 -G nodejs
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+# /app dibuat root oleh WORKDIR, jadi folder tulis harus dibuat & di-chown eksplisit
+RUN mkdir -p /app/data && chown nextjs:nodejs /app/data
 USER nextjs
 EXPOSE 3000
 CMD ["node", "server.js"]
diff --git a/data/.gitkeep b/data/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index d501602..2c05044 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -10,3 +10,5 @@ services:
     logging:
       driver: json-file
       options: { max-size: "100m", max-file: "5" }
+    volumes:
+      - ./data:/app/data
diff --git a/docker-compose.local.yml b/docker-compose.local.yml
index e09a6e6..1ce24be 100644
--- a/docker-compose.local.yml
+++ b/docker-compose.local.yml
@@ -6,3 +6,5 @@ services:
     build: .
     ports:
       - "${PORT_LOCAL:-3000}:3000"
+    volumes:
+      - ./data:/app/data
diff --git a/docker-compose.yml b/docker-compose.yml
index 5c566bb..8cab885 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -10,3 +10,5 @@ services:
     logging:
       driver: json-file
       options: { max-size: "100m", max-file: "5" }
+    volumes:
+      - ./data:/app/data
diff --git a/makefile b/makefile
index 85ca288..7668110 100644
--- a/makefile
+++ b/makefile
@@ -43,7 +43,7 @@ help: ## Tampilkan daftar perintah
 		| awk -F'|' '{printf "  %-16s %s\n", $$1, $$2}'
 
 # ---- deploy ----
-deploy-%: log-dir ## Pull + build + up (prod/dev)
+deploy-%: log-dir data-dir-% ## Pull + build + up (prod/dev)
 	@$(LOG) start $(PROJECT) $* || true
 	@cd $(WORK_DIR) || exit 1; \
 	( \
@@ -58,7 +58,7 @@ deploy-%: log-dir ## Pull + build + up (prod/dev)
 	exit $$RC
 
 # ---- operasional ----
-up-%: ## Build + start container
+up-%: data-dir-% ## Build + start container
 	@cd $(WORK_DIR) && $(DC) up -d --build --remove-orphans
 
 stop-%: ## Stop container
@@ -92,3 +92,7 @@ ps: ## Status semua container
 log-dir:
 	@sudo mkdir -p $(LOG_DIR)/$(PROJECT) && sudo touch $(OUT_FILE) \
 		&& sudo chown -R $$(id -u):$$(id -g) $(LOG_DIR)/$(PROJECT)
+
+# folder data di-bind ke /app/data; user container (nextjs) ber-UID 1001
+data-dir-%:
+	@cd $(WORK_DIR) && sudo mkdir -p data && sudo chown -R 1001:1001 data
diff --git a/src/app/api/contact/route.ts b/src/app/api/contact/route.ts
index bd399d8..e7d6bb3 100644
--- a/src/app/api/contact/route.ts
+++ b/src/app/api/contact/route.ts
@@ -4,7 +4,8 @@ import path from "path";
 
 export const runtime = "nodejs";
 
-const DATA_DIR = path.join(process.cwd(), "data");
+// Bisa dioverride lewat env kalau folder kerja tidak writable (mis. container).
+const DATA_DIR = process.env.CONTACT_DATA_DIR || path.join(process.cwd(), "data");
 const DATA_FILE = path.join(DATA_DIR, "contact-messages.json");
 
 interface ContactMessage {