git "detected dubious ownership": clone from a container, then every git command fails on the host

verbatim errorfatal: detected dubious ownership in repository at '/srv/build' To add an exception for this directory, call: git config --global --add safe.directory /srv/build

Problem

A build runner wrote the checkout, then the host's git refuses every command:

fatal: detected dubious ownership in repository at '/srv/build'
To add an exception for this directory, call:
	git config --global --add safe.directory /srv/build

Same repo, same path, works for the user who owns the files. Every other account — root, CI user, a second developer with sudo — gets the fatal.

Root cause

Since git 2.35.2 (the fix for CVE-2022-24765), git refuses to operate on a repository whose .git directory is owned by a different user than the one running the command. This is a feature: a malicious repo could otherwise plant .git/config options that execute code when a privileged user runs git inside it. The message's suggested fix is a per-path trust exception — fine for one directory, a foot-gun as a habit (it re-disables the CVE protection for whatever path you whitelisted, which matters if the path is writable by someone else).

🔒 the fix — including 4 code blocks — is members-only. $1/mo unlocks everything.