diff --git a/docker/Dockerfile.soda b/docker/Dockerfile.soda
index 77ff0ef3db4fd205e830fc372f381e96a6f7f714..0f36e2c862cdb521b8bb92d7ebc7f284865fcc1b 100644
--- a/docker/Dockerfile.soda
+++ b/docker/Dockerfile.soda
@@ -40,7 +40,7 @@ COPY deps/ast_9.2.9-1_amd64.deb ./
 RUN dpkg -i /root/ast_9.2.9-1_amd64.deb && ldconfig \
  && mkdir -p ${WEBAPP_DIR} \
  && mkdir -p /srv/datasets \
- && mkdir --mode 777 /srv/cutouts \
+ && mkdir -p /srv/cutouts \
  && mkdir -p /etc/pki/tls
 
 ARG VLKB_VERSION
@@ -65,6 +65,8 @@ RUN chmod -R a+rwX ${WEBAPP_DIR}/WEB-INF \
  && touch  ${WEBAPP_DIR}/WEB-INF/classes/iamtoken.properties \
  && chmod a+rw ${WEBAPP_DIR}/WEB-INF/classes/*.properties
 
+# FIXME must use 1002: regardless how /srv/cutouts is created
+# in container it is owned by user 1002:1002 with rwxr-xr-x
 RUN groupadd --gid 1002 admin \
  && useradd --uid 1002 --gid admin --shell /bin/bash --create-home --no-log-init admin