Move docker group logic to bootsync, so it happens early enough in the boot process to be effective