Moved out of their containers, their code runs as the node runtime's account, which may not read the app's config directory: it belongs to the account the app runs as on that machine, mode 0700. Read the file directly when allowed, else through the app's own container, which owns it.