extract only the dockerize binary, owned by root

Since v0.10 the dockerize release tarball also ships LICENSE and
README.md. We only moved the binary out, and WORKDIR /app is set before
this step, so both files were left in /app of every image (and of every
prod app that doesn't ship its own copies).

tar also restored the archive's owner, so /usr/local/bin/dockerize was
owned by uid 1001 (501 with v0.9.3). The entrypoint runs dockerize as
root on every start, so when ASUSER matched that uid the kool user could
replace it and get root on the next restart.

Extract just the binary straight into /usr/local/bin, without restoring
ownership, and assert both in test-image.sh.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: fabriciojs

8.2-prod/Dockerfile

@@ -21,8 +21,7 @@ RUN adduser -D -u 1337 kool \
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \

8.2/Dockerfile

@@ -22,8 +22,7 @@ RUN adduser -D -u 1337 kool \
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \

8.3-prod/Dockerfile

@@ -21,8 +21,7 @@ RUN adduser -D -u 1337 kool \
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \

8.3/Dockerfile

@@ -22,8 +22,7 @@ RUN adduser -D -u 1337 kool \
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \

8.4-debian-prod/Dockerfile

@@ -21,8 +21,7 @@ RUN useradd -m -u 1337 kool \
     && usermod -aG www-data kool \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # gosu
     && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
     && curl -L "https://github.com/tianon/gosu/releases/download/1.17/gosu-${GOSU_ARCH}" -o /usr/local/bin/gosu \

8.4-debian/Dockerfile

@@ -22,8 +22,7 @@ RUN useradd -m -u 1337 kool \
     && usermod -aG www-data kool \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # gosu
     && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
     && curl -L "https://github.com/tianon/gosu/releases/download/1.17/gosu-${GOSU_ARCH}" -o /usr/local/bin/gosu \

8.4-prod/Dockerfile

@@ -21,8 +21,7 @@ RUN adduser -D -u 1337 kool \
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \

8.4/Dockerfile

@@ -22,8 +22,7 @@ RUN adduser -D -u 1337 kool \
     && addgroup kool www-data \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # deps
     && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \
         freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \

8.5-debian-prod/Dockerfile

@@ -21,8 +21,7 @@ RUN useradd -m -u 1337 kool \
     && usermod -aG www-data kool \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # gosu
     && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
     && curl -L "https://github.com/tianon/gosu/releases/download/1.17/gosu-${GOSU_ARCH}" -o /usr/local/bin/gosu \

8.5-debian/Dockerfile

@@ -22,8 +22,7 @@ RUN useradd -m -u 1337 kool \
     && usermod -aG www-data kool \
     # dockerize
     && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
-    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \
-    && mv dockerize /usr/local/bin/dockerize \
+    && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \
     # gosu
     && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \
     && curl -L "https://github.com/tianon/gosu/releases/download/1.17/gosu-${GOSU_ARCH}" -o /usr/local/bin/gosu \