Rather than require a heavy chown operation across various paths, just chown the files already in the built image during the release process. This ensures we can skip not-only the chown process during the container start that herokuish injects, but also the one that Dokku runs which modifies mounted container paths as well during the pre-deploy.
Note that users will need to ensure any mounted volumes don't have permissions reset by other processes or containers won't be able to access them.
Herokuish app builds currently spin up a temporary container and then commit that container. The new approach uses a Dockerfile to perform those same actions, avoiding the need for the temporary container.