Thank you @Kamilcuk, your suggestion pointed me the right way.
id in the container returned 0, but the share is owned on my NAS by a user 999. I simply set user = "999" in the task "application" stanza, and the permission errors disappeared!