diff --git a/docker/webapp/Dockerfile b/docker/webapp/Dockerfile
index 2dfcd5ef..5511ecbc 100755
--- a/docker/webapp/Dockerfile
+++ b/docker/webapp/Dockerfile
@@ -1,21 +1,27 @@
 FROM apheleia/swoole:latest
 
 MAINTAINER Jeroen van Meeuwen <vanmeeuwen@apheleia-it.ch>
 
 USER root
 
 RUN dnf -y install findutils gnupg2 git rsync procps-ng php-sodium
 
 EXPOSE 8000
 
 ARG GIT_REF=master
 ARG GIT_REMOTE=https://git.kolab.org/source/kolab.git
 ARG CONFIG=config.prod
 COPY build.sh /build.sh
-RUN /build.sh
+RUN /build.sh && \
+    chgrp -R 0 /opt/app-root/src && \
+    chmod -R g=u /opt/app-root/src && \
+    chown -R 1001:0 /opt/app-root/src
+
 COPY init.sh /init.sh
 COPY update.sh /update.sh
 
+USER 1001
+
 ENV KOLAB_ROLE=combined
 
 CMD [ "/init.sh" ]
diff --git a/docker/webapp/build.sh b/docker/webapp/build.sh
index cf2b78fc..8800eef6 100755
--- a/docker/webapp/build.sh
+++ b/docker/webapp/build.sh
@@ -1,37 +1,37 @@
 #!/bin/bash
 set -e
 set -x
 
 echo -e "Building with the following ulimit: limit: $(ulimit -n)\n"
 echo -e "If you run into EMFILE errors, this is the reason"
 
 mkdir /src
 cd /src
 
 git clone --branch $GIT_REF $GIT_REMOTE kolab
 pushd kolab
 git reset --hard $GIT_REF
 #TODO support injecting a custom overlay into the build process here
 bin/configure.sh $CONFIG
 # In the docker-compose case we copy the .env file during the init phase, otherwise we use the environment for configuration.
 rm src/.env
 popd
 
-rmdir /opt/app-root/src
+rm -rf /opt/app-root/src
 cp -a kolab/src /opt/app-root/src
 cd /opt/app-root/src/
 
 mkdir -p storage/framework/{sessions,views,cache}
 mkdir -p database/seeds
 
 php -dmemory_limit=-1 $(command -v composer) install
 npm -g install npm
 /usr/local/bin/npm install
 ./artisan storage:link
 ./artisan clear-compiled
 ./artisan horizon:install
 if [ ! -f 'resources/countries.php' ]; then
     ./artisan data:countries
 fi
 
 /usr/local/bin/npm run dev