This makes sure it belongs to the user running the build process.  If we
create it during root.sh it will belong to root and not be writeable
later on when we want to indicate a tainted image.

Closes: #31