Docker role

Fixes #1207
Do we monitor and detect when the set of groups changes so this property can be updated?