if we can make r10k use GID0 immediately and it won't have issues interoperating with the current state of play of the openvox containers then i am all for that - i'm just nervous that the puppetserver container might need a lot more work to get to that state due to the sheer number of moving parts still - but r10k is at least a small well contained (pun intended) piece of work that this is relatively safe we just need to do something that being said - we might want to check r10k - when i worked around file permissions issues yesterday it wasn't a complete fix - i eventually got to r10k the executable failing to run because 64604 was not a valid/present UID in /etc/passwd