diff --git a/scm_config/git-http/Dockerfile b/scm_config/git-http/Dockerfile
index 1bca3a1..9673421 100644
--- a/scm_config/git-http/Dockerfile
+++ b/scm_config/git-http/Dockerfile
@@ -26,7 +26,8 @@
     apache2 \
     libapache2-mod-python \
     git \
-    curl
+    curl \
+    sudo
 
 
 ENV APACHE_RUN_USER www-data
@@ -46,7 +47,8 @@
 RUN a2dissite 000-default.conf
 RUN a2ensite git-http.conf
 
-# so that git operations run as root, and can modify the scm repo files
-RUN chmod u+s /usr/lib/git-core/git-http-backend
+ADD git-http-backend-wrapper.sh /usr/lib/git-core
+RUN adduser www-data sudo
+RUN echo '%sudo  ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/sudo_group_passwordless
 
 CMD ["/usr/sbin/apache2", "-D", "FOREGROUND"]
\ No newline at end of file
diff --git a/scm_config/git-http/git-http-backend-wrapper.sh b/scm_config/git-http/git-http-backend-wrapper.sh
new file mode 100755
index 0000000..1daa8de
--- /dev/null
+++ b/scm_config/git-http/git-http-backend-wrapper.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+# This is so that git operations run as root, and can modify the scm repo files
+#
+# Up until git 2.11 and https://git.kernel.org/pub/scm/git/git.git/commit/?id=722ff7f876c8a2ad99c42434f58af098e61b96e8
+# it was sufficient to `chmod u+s git-http-backend` so it ran as root, but that no longer works.
+#
+# A better fix would be to have files/dirs group owned by www-data but I tried that manually and didn't work
+# maybe could put a "strace" within this command and hunt through all the files/dirs it writes to, to see what it
+# writes to that www-data can't write to currently
+# https://stackoverflow.com/a/46676868 or similar needed for strace to work thoguh
+
+sudo --preserve-env /usr/lib/git-core/git-http-backend
diff --git a/scm_config/git-http/git-http.conf b/scm_config/git-http/git-http.conf
index 6919ed7..7ac0acf 100644
--- a/scm_config/git-http/git-http.conf
+++ b/scm_config/git-http/git-http.conf
@@ -24,7 +24,7 @@
     # /git/ requests go to the git backend binary
     SetEnv GIT_PROJECT_ROOT /allura-data/scm/git
     SetEnv GIT_HTTP_EXPORT_ALL
-    ScriptAlias /git/ /usr/lib/git-core/git-http-backend/
+    ScriptAlias /git/ /usr/lib/git-core/git-http-backend-wrapper.sh/
 
     # disable access to default web content
     <Directory /var/www>