run as root until docker volumes provide configurable permissions