Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions