init: don't clobber existing docker group members (this is needed on container restart)