diff --git a/gerrit/Dockerfile.entrypoint b/gerrit/Dockerfile.entrypoint
new file mode 100644
index 0000000..6aa141b
--- /dev/null
+++ b/gerrit/Dockerfile.entrypoint
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -e
+
+# Allows us to bind mount arbitrary owned files
+chown -R gerrit:gerrit /var/gerrit/{logs,etc,db,git,index,cache}/
+
+# Drop privileges as we set `USER root` only to change file permissions
+exec setpriv --reuid=gerrit --regid=gerrit --init-groups --inh-caps=-all /unprivileged.sh "$@"