Rather than require a heavy chown operation across various paths, just chown the files already in the built image during the release process. This ensures we can skip not-only the chown process during the container start that herokuish injects, but also the one that Dokku runs which modifies mounted container paths as well during the pre-deploy.
Note that users will need to ensure any mounted volumes don't have permissions reset by other processes or containers won't be able to access them.
The previous method used an ephemeral container, which was slightly more convoluted and required cleanup. The new method also allows us to set an initial WORKDIR, which is useful for ensuring 'docker exec' works as expected.
Herokuish app builds currently spin up a temporary container and then commit that container. The new approach uses a Dockerfile to perform those same actions, avoiding the need for the temporary container.
