The Docker group is root access, my agent used it to write to /etc.