diff --git a/deploy/webmail.sh b/deploy/webmail.sh
index 3d8ce6a..c78463c 100755
--- a/deploy/webmail.sh
+++ b/deploy/webmail.sh
@@ -234,6 +234,10 @@ cmd_doctor() {
     require_env
     local ok=0
 
+    if [ ! -s "$ENV_FILE" ]; then
+        red "  $ENV_FILE is missing or empty — nothing will start. Run: webmail.sh init" >&2
+    fi
+
     echo "config:"
     echo "  DATA_ROOT      ${DATA_ROOT}"
     echo "  APP_DOMAIN     ${APP_DOMAIN:-<unset>}"
diff --git a/docker-compose.yml b/docker-compose.yml
index e65d2f9..f78e79a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -21,6 +21,10 @@
 #   Start:  ./deploy/webmail.sh up
 #   Manual: docker compose up -d          (reads .env from this directory)
 #
+#   The odd-looking DATA_ROOT default is deliberate: if no .env is found, the
+#   daemon's "Bind mount failed: '<path>' does not exist" error then names the
+#   fix instead of pointing at a directory nobody meant to create.
+#
 #   Likewise, no `cpus:` limits: that maps to NanoCPUs, which DSM's Docker
 #   daemon rejects ("NanoCPUs can not be set"). mem_limit uses the much older
 #   Memory field and works fine, so memory caps are the throttle here.
@@ -99,10 +103,10 @@ services:
         chmod 700 /mnt/backups
         echo "[init] data directories ready"
     volumes:
-      - ${DATA_ROOT:-/DATA_ROOT-is-unset}/blobs:/mnt/blobs
-      - ${DATA_ROOT:-/DATA_ROOT-is-unset}/backups:/mnt/backups
-      - ${DATA_ROOT:-/DATA_ROOT-is-unset}/redis:/mnt/redis
-      - ${DATA_ROOT:-/DATA_ROOT-is-unset}/meili:/mnt/meili
+      - ${DATA_ROOT:-/NO-.env-FOUND-RUN-deploy_webmail.sh-init-FIRST}/blobs:/mnt/blobs
+      - ${DATA_ROOT:-/NO-.env-FOUND-RUN-deploy_webmail.sh-init-FIRST}/backups:/mnt/backups
+      - ${DATA_ROOT:-/NO-.env-FOUND-RUN-deploy_webmail.sh-init-FIRST}/redis:/mnt/redis
+      - ${DATA_ROOT:-/NO-.env-FOUND-RUN-deploy_webmail.sh-init-FIRST}/meili:/mnt/meili
     restart: "no"
     logging: *logging
 
@@ -130,7 +134,7 @@ services:
       - effective_cache_size=${PG_EFFECTIVE_CACHE_SIZE:-768MB}
       # Full page writes stay ON: NAS filesystems (btrfs/ext4) are not 8k-atomic.
     volumes:
-      - ${DATA_ROOT:-/DATA_ROOT-is-unset}/postgres:/var/lib/postgresql/data
+      - ${DATA_ROOT:-/NO-.env-FOUND-RUN-deploy_webmail.sh-init-FIRST}/postgres:/var/lib/postgresql/data
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-webmail} -d ${POSTGRES_DB:-webmail}"]
       interval: 10s
@@ -157,7 +161,7 @@ services:
       - --maxmemory-policy
       - noeviction
     volumes:
-      - ${DATA_ROOT:-/DATA_ROOT-is-unset}/redis:/data
+      - ${DATA_ROOT:-/NO-.env-FOUND-RUN-deploy_webmail.sh-init-FIRST}/redis:/data
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 10s
@@ -180,7 +184,7 @@ services:
       MEILI_NO_ANALYTICS: "true"
       TZ: ${TZ:-UTC}
     volumes:
-      - ${DATA_ROOT:-/DATA_ROOT-is-unset}/meili:/meili_data
+      - ${DATA_ROOT:-/NO-.env-FOUND-RUN-deploy_webmail.sh-init-FIRST}/meili:/meili_data
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:7700/health | grep -q available"]
       interval: 10s
@@ -203,7 +207,7 @@ services:
       <<: *backend-env
       ENABLED_PLUGINS: ${ENABLED_PLUGINS:-calendar contacts labels filters}
     volumes:
-      - ${DATA_ROOT:-/DATA_ROOT-is-unset}/blobs:/data/blobs
+      - ${DATA_ROOT:-/NO-.env-FOUND-RUN-deploy_webmail.sh-init-FIRST}/blobs:/data/blobs
     depends_on:
       postgres: { condition: service_healthy }
       init: { condition: service_completed_successfully }
@@ -215,7 +219,7 @@ services:
     command: ["api"]
     environment: *backend-env
     volumes:
-      - ${DATA_ROOT:-/DATA_ROOT-is-unset}/blobs:/data/blobs
+      - ${DATA_ROOT:-/NO-.env-FOUND-RUN-deploy_webmail.sh-init-FIRST}/blobs:/data/blobs
     healthcheck:
       test: ["CMD-SHELL", "python -c \"import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/api/healthz', timeout=5).status==200 else 1)\""]
       interval: 30s
@@ -235,7 +239,7 @@ services:
     command: ["worker-sync"]
     environment: *backend-env
     volumes:
-      - ${DATA_ROOT:-/DATA_ROOT-is-unset}/blobs:/data/blobs
+      - ${DATA_ROOT:-/NO-.env-FOUND-RUN-deploy_webmail.sh-init-FIRST}/blobs:/data/blobs
     # Persistent IMAP IDLE connections; the default 1024 is fine for a personal
     # install but this costs nothing and matches the sync-engine v2 sizing.
     ulimits:
@@ -255,7 +259,7 @@ services:
     command: ["worker-jobs"]
     environment: *backend-env
     volumes:
-      - ${DATA_ROOT:-/DATA_ROOT-is-unset}/blobs:/data/blobs
+      - ${DATA_ROOT:-/NO-.env-FOUND-RUN-deploy_webmail.sh-init-FIRST}/blobs:/data/blobs
     ulimits:
       nofile: { soft: 8192, hard: 8192 }
     depends_on:
@@ -310,7 +314,7 @@ services:
       BACKUP_KEEP_DAYS: ${BACKUP_KEEP_DAYS:-14}
       TZ: ${TZ:-UTC}
     volumes:
-      - ${DATA_ROOT:-/DATA_ROOT-is-unset}/backups:/backups
+      - ${DATA_ROOT:-/NO-.env-FOUND-RUN-deploy_webmail.sh-init-FIRST}/backups:/backups
       - ./docker/backup.sh:/usr/local/bin/backup.sh:ro
     depends_on:
       postgres: { condition: service_healthy }