[fabriciojs]

• Upgrade jwilder/dockerize from v0.9.3 to v0.15.2. Includes the upgrade proposed in Atualização do Jwilder Dockerize para versão 0.15.2 #134, with @diogofm7's commit kept as is.
• Extract only the dockerize binary into /usr/local/bin and don't keep the archive's file owner. Since v0.10 the release tarball also ships LICENSE and README.md. WORKDIR /app is set before this step, so Atualização do Jwilder Dockerize para versão 0.15.2 #134 alone would have left both files in /app of every image, and of every prod app that doesn't ship its own copies.
• Have test-image.sh check that /usr/local/bin/dockerize is owned by 0:0 and that /app has no LICENSE/README.md.

The ownership problem is not new. The published images ship dockerize owned by 501:20, the uid baked into the v0.9.3 tarball, and #134 would have changed that to 1001:1001. The entrypoint runs dockerize as root on every start. So when ASUSER matched the owning uid (501 is the default macOS user; 1001 is the GitHub Actions runner and the usual second Linux user), the kool user, which runs the php-fpm workers, could overwrite the binary and get root on the next container restart.

Upstream changes between the two versions don't affect how these images use dockerize (only -template in the entrypoints):

• With the default env vars, kool.ini, zz-docker.conf and default.conf render byte-identical to v0.9.3 on 8.4-nginx, 8.4-nginx-prod and 8.4-debian-nginx, and nginx -t / php-fpm -t pass.
• Unset vars still render <no value>. -wait behaves the same on success and on timeout. Running a command still passes its exit code through. Both binaries are still statically linked.
• One behavior change: isTrue now treats yes/on as true. In these templates that only affects NGINX_HTTPS.

This deliberately stops at v0.15.2. v0.16.0 rejects flag combinations it used to ignore and validates -wait URLs and timeouts at startup, which could break downstream dockerize -wait command lines. It deserves its own PR.

Tested locally: built 8.4 and 8.4-debian from this branch and the full test-image.sh passes on both. The generated Dockerfiles match the templates. The -prod/-nginx variants weren't built locally; their install line is the same, and CI builds the full matrix.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The focused installation changes are consistent across templates and generated files, with targeted regression checks and no unresolved findings.

No open issues 🎉

What changed in this PR

Upgrades dockerize to v0.15.2 across the PHP images and hardens installation by keeping the binary root-owned and excluding bundled documentation.

Changes:

• Update both Dockerfile templates and all generated variants to v0.15.2.
• Extract only dockerize into /usr/local/bin without preserving archive ownership.
• Add regression checks for 0:0 ownership and absence of archive documentation in /app.

File	Description
template/​Dockerfile.blade.php	Update and harden Alpine installation template.
template/​Dockerfile-debian.blade.php	Update and harden Debian installation template.
scripts/​test-image.sh	Check binary ownership and clean /app contents.
8.5/​Dockerfile	Apply updated installation to PHP 8.5 Alpine.
8.5-prod/​Dockerfile	Apply updated installation to PHP 8.5 Alpine production.
8.5-debian/​Dockerfile	Apply updated installation to PHP 8.5 Debian.
8.5-debian-prod/​Dockerfile	Apply updated installation to PHP 8.5 Debian production.
8.4/​Dockerfile	Apply updated installation to PHP 8.4 Alpine.
8.4-prod/​Dockerfile	Apply updated installation to PHP 8.4 Alpine production.
8.4-debian/​Dockerfile	Apply updated installation to PHP 8.4 Debian.
8.4-debian-prod/​Dockerfile	Apply updated installation to PHP 8.4 Debian production.
8.3/​Dockerfile	Apply updated installation to PHP 8.3 Alpine.
8.3-prod/​Dockerfile	Apply updated installation to PHP 8.3 Alpine production.
8.2/​Dockerfile	Apply updated installation to PHP 8.2 Alpine.
8.2-prod/​Dockerfile	Apply updated installation to PHP 8.2 Alpine production.

_{Review effort: Balanced}