Mac uses low group IDs for the default user, which would cause groupadd to fail as the group already existed. Only make a new group if it doesn't already exist. This does raise other questions though as now we are technically having the container run with a "services" group.