The images already run with GID 0, this is only not the case in k8s as the GID from the image is dropped. -> docker run --rm --entrypoint id ghcr.io/openvoxproject/openvoxserver:latest uid=64604(puppet) gid=0(root) groups=0(root) About the runtime JAR: -> docker run --rm --entrypoint ls ghcr.io/openvoxproject/openvoxserver:latest -ln /opt/puppetlabs/server/apps/puppetserver/puppet-server-release.jar -rw-rw-r-- 1 0 0 76693941 Jul 24 20:42 /opt/puppetlabs/server/apps/puppetserver/puppet-server-release.jar Yea, I suppose that should be fixed. The correct approach is to tighten the permissions then, remove group write for the JAR. Worth checking other potential issues like that. I did not know about this, thanks. At my work we run the image without k8s, so with the default GID 0. So, I'm happy to follow this up a bit more tomorrow.