Configuring user permissions in docker-compose - windows

Question

I have struggled the past few days with getting docker volumes to use the correct permissions with a headless ubuntu server. I am very new to docker and still a novice with ubuntu so it may well be obvious to others!
My setup:
I have a mini-PC with a relatively small SSD running Windows.
I have an ubuntu server that has multiple (old) HDD that combine to form a storage pool for all my media (photos, movies etc)
I run emby server on the Windows machine to manage the media. However, I use the server for the emby cache and transcoding as I want to minimise the read/write activity on the SSD to prolong its life.
Because I use emby away from home too, I have a VPN to protect my home network with port-forwarding. But because I don't want all my traffic on the VPN I recently decided to try to move emby and the VPN to a docker container so that I could use the Windows PC for other purposes too (and because I wanted to learn a bit on Docker).
I had managed to get my original emby server working with ubuntu network folders by using SAMBA and I also ultimately had to set all permissions on the relevant ubuntu folders with the media to 2777 so that I could get windows to communicate with read/write access. That in itself might suggest a problem.
Note: I have created a user:group on ubuntu called emby:emby and the uid:gid is 996:998.
But for the life of me I am unable to get emby server as a docker container running with the correct permissions as whenever emby needs to access the ubuntu folders to write (it can read fine) then a get an access denied error in the logs. This was not the case when emby server ran on Windows outside a docker container (although as mentioned I had to open all the security of the folders up to get it working).
What I have tried (without any success):
removed VPN
set uid:gid to 996:998 in docker-compose (I have also tried other users like 1000:1000 as root)
I have tried to test by creating a new file from the windows PC into an ubuntu network folder and double-checked that the user:group is emby:emby (which it is)
I also mapped the relevant ubuntu folder to a Windows drive and used this Windows drive in docker-compose
tried changing in the emby container to the network-mode: bridge in emby server
removed the FIREWALL
But I have run out of ideas and nothing I find on google seems to provide the detail I need. Below is my docker-compose file and any suggestion are very welcome! Note I may need my hand-held to walk through the steps...
version: '3.7'
volumes:
emby-movies:
driver_opts:
type: cifs
o: "user=u,password=p,file_mode=0777,dir_mode=0777,iocharset=utf8,vers=3.1.1,rw,uid=996,gid=998,sec=ntlmssp"
device: //192.168.1.162/Entertainment/Movies
emby-tvshows:
driver_opts:
type: cifs
o: "user=u,password=p,file_mode=0777,dir_mode=0777,iocharset=utf8,vers=3.1.1,rw,uid=996,gid=998,sec=ntlmssp"
device: //192.168.1.162/Entertainment/TV_Shows
emby-cache:
driver_opts:
type: cifs
o: "user=u,password=p,file_mode=0777,dir_mode=0777,iocharset=utf8,vers=3.1.1,rw,uid=996,gid=998,sec=ntlmssp"
device: //192.168.1.162/EmbyCache/cache
emby-homepictures:
driver_opts:
type: cifs
o: "user=u,password=p,file_mode=0777,dir_mode=0777,iocharset=utf8,vers=3.1.1,rw,uid=996,gid=998,sec=ntlmssp"
device: //192.168.1.162/Multimedia/Pictures
emby-homevideos:
driver_opts:
type: cifs
o: "user=u,password=p,file_mode=0777,dir_mode=0777,iocharset=utf8,vers=3.1.1,rw,uid=996,gid=998,sec=ntlmssp"
device: //192.168.1.162/Multimedia/Home_Videos
services:
gluetun:
image: qmcgaw/gluetun
container_name: provider
cap_add:
- NET_ADMIN
environment:
- VPN_SERVICE_PROVIDER=zzz
- OPENVPN_USER=xxx
- OPENVPN_PASSWORD=yyy
- SERVER_CITIES=Paris,Lisbon,Prague
- FIREWALL_OUTBOUND_SUBNETS=192.168.1.0/24
ports:
- 7170:7170 # emby HTTP port
- 7180:7180 # emby HTTPS port
volumes:
- C:\Docker\gluetun:/gluetun
restart: unless-stopped
emby:
image: emby/embyserver
container_name: embyserver
network_mode: "service:gluetun" # VPN
environment:
- UID=996 # The UID to run emby as (default: 2)
- GID=998 # The GID to run emby as (default 2)
# - GIDLIST=100 # A comma-separated list of additional GIDs to run emby as (default: 2)
volumes:
- C:\Docker\Emby_Data:/config # Configuration directory
- emby-cache:/mnt/cache # cache directory
- emby-tvshows:/mnt/tvshows # Media directory
- emby-movies:/mnt/movies # Media directory
- emby-homepictures:/mnt/homepictures # Media directory
- emby-homevideos:/mnt/homevideos # Media directory
restart: unless-stopped