diff --git a/docker/pulsar/Dockerfile b/docker/pulsar/Dockerfile
index a127af166eb52..b465bbf251da8 100644
--- a/docker/pulsar/Dockerfile
+++ b/docker/pulsar/Dockerfile
@@ -36,10 +36,14 @@ COPY scripts/install-pulsar-client.sh /pulsar/bin
 
 # The final image needs to give the root group sufficient permission for Pulsar components
 # to write to specific directories within /pulsar
+# The ownership is changed to uid 10000 to allow using a different root group. This is necessary when running the
+# container when gid=0 is prohibited. In that case, the container must be run with uid 10000 with
+# any group id != 0 (for example 10001).
 # The file permissions are preserved when copying files from this builder image to the target image.
 RUN for SUBDIRECTORY in conf data download logs; do \
      [ -d /pulsar/$SUBDIRECTORY ] || mkdir /pulsar/$SUBDIRECTORY; \
-     chmod -R g+w /pulsar/$SUBDIRECTORY; \
+     chmod -R ug+w /pulsar/$SUBDIRECTORY; \
+     chown -R 10000:0 /pulsar/$SUBDIRECTORY; \
      done
 
 # Trino writes logs to this directory (at least during tests), so we need to give the process permission