The latest (and firest) testing images contains a "/var/lib/knot-resolver" directory with a wrong ownership. This should be "knot-resolver:knot-resolver" instead of "root:root".
> https://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=240827441761c4eb7640d0cf98e857659cb66cfb