RUN for d in \
    /etc/puppetlabs \
    /var/log/puppetlabs \
    /var/run/puppetlabs \
    /opt/puppetlabs/ \
  ; do \
    mkdir -p "$d"; \
    chgrp -R 0 "$d"; \
    chmod -R g=u "$d"; \
    find "$d" -type d -exec chmod g+s {} +; \
  done

Here is the part in the Containerfile that sets the group permissions