diff --git a/Dockerfile b/Dockerfile
index 725fdef..0f2357c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,8 +22,11 @@ WORKDIR $CONFLUENCE_HOME
 EXPOSE 8090
 EXPOSE 8091
 
-CMD ["/entrypoint.py"]
-ENTRYPOINT ["/usr/bin/tini", "--"]
+COPY entrypoint.py \
+     shutdown-wait.sh \
+     shared-components/image/entrypoint_helpers.py  /
+COPY shared-components/support /opt/atlassian/support
+COPY config/*                 /opt/atlassian/etc/
 
 RUN apt-get update \
     && apt-get upgrade -y \
@@ -47,7 +50,9 @@ RUN groupadd --gid ${RUN_GID} ${RUN_GROUP} \
     && chown -R ${RUN_USER}:${RUN_GROUP}            ${CONFLUENCE_INSTALL_DIR}/temp \
     && chown -R ${RUN_USER}:${RUN_GROUP}            ${CONFLUENCE_INSTALL_DIR}/work \
     && chown -R ${RUN_USER}:${RUN_GROUP}            ${CONFLUENCE_HOME} \
-    \
+    && for file in "/opt/atlassian/support /entrypoint.py /entrypoint_helpers.py /shutdown-wait.sh"; do \
+       chmod -R "u=rwX,g=rX,o=rX" ${file} && \
+       chown -R root ${file}; done \
     && sed -i -e 's/-Xms\([0-9]\+[kmg]\) -Xmx\([0-9]\+[kmg]\)/-Xms\${JVM_MINIMUM_MEMORY:=\1} -Xmx\${JVM_MAXIMUM_MEMORY:=\2} -Dconfluence.home=\${CONFLUENCE_HOME}/g' ${CONFLUENCE_INSTALL_DIR}/bin/setenv.sh \
     && sed -i -e 's/-XX:ReservedCodeCacheSize=\([0-9]\+[kmg]\)/-XX:ReservedCodeCacheSize=${JVM_RESERVED_CODE_CACHE_SIZE:=\1}/g' ${CONFLUENCE_INSTALL_DIR}/bin/setenv.sh \
     && sed -i -e 's/export CATALINA_OPTS/CATALINA_OPTS="\${CATALINA_OPTS} \${JVM_SUPPORT_RECOMMENDED_ARGS} -DConfluenceHomeLogAppender.disabled=${CONFLUENCE_LOG_STDOUT}"\n\nexport CATALINA_OPTS/g' ${CONFLUENCE_INSTALL_DIR}/bin/setenv.sh \
@@ -57,8 +62,5 @@ RUN groupadd --gid ${RUN_GID} ${RUN_GROUP} \
 
 VOLUME ["${CONFLUENCE_HOME}"] # Must be declared after setting perms
 
-COPY entrypoint.py \
-     shutdown-wait.sh \
-     shared-components/image/entrypoint_helpers.py  /
-COPY shared-components/support                      /opt/atlassian/support
-COPY config/*                                       /opt/atlassian/etc/
+CMD ["/entrypoint.py"]
+ENTRYPOINT ["/usr/bin/tini", "--"]