i guess i would have naively expected permissions issues on the socket to be all or nothing, so the fact that all queries return to the client in the second container, sometimes with the correct result set, sometimes with an empty result set, is confusing.