So, if you agree with the principle then it's best to not merge that PR though. That'd mean another migration for users, from UID/GID 999 to UID/GID 64604 to finally GID 0. If interested, I would like to do three things until friday: 1) Prep r10k PR to use GID 0 directly, arbitrary UIDs. 2) Fix the migration guide in the server repo to properly instruct users to use GID 0, not GID 64604. Also remove 87-ca-permissions, it's antithetical to OpenShift compatibility and a regression introduced in the 'big restructure'. 3) Add arbitrary UID support to the openvoxdb image (actually got a fork for that ready already) and add migration guide. During that the notion of the puppet user can easily be removed. It's not a lofty goal or a very difficult migration for users, just: "use GID 0" - that's it. The default UID can still stay 64604, no problem. So users wanting to run it with that UID can continue doing that. Only need to be mindful of the GID. BTW, I mentioned #192 before, I believe that's the direct result of following the faulty migration doc in the server repo (applying GID 64604). What do you think @rwaffen? Can I go ahead?