diff --git a/Dockerfile b/Dockerfile
index ee12922f2..82980101b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -85,3 +85,7 @@ COPY --from=build-env /go/bin/* /usr/local/bin/
 # For compat with the previous run.sh, although ideally you should be
 # using build_docker.sh which sets an entrypoint for the image.
 RUN mkdir /tailscale && ln -s /usr/local/bin/containerboot /tailscale/run.sh
+RUN addgroup mygroup && \
+    adduser -D -G mygroup insecure && \
+    adduser -D -G mygroup xinsecure && \
+    adduser -D -G mygroup Xinsecure