Repository: syncthing/syncthing (language: go)

Issue:
Docker RC - Fails to start at entrypoint 'PCAP: parameter not set' 
On startup Docker Swarm now gives the following error with the latest release candidate:
`/bin/entrypoint.sh: line 7: PCAP: parameter not set`

This looks like it comes from #8552 as the `latest` (non-rc) tag works correctly (albeit unhappy about the config downgrade as expected)

### Include required information

Version: Latest `syncthing/syncthing:rc`
Attached below is my compose which I'm deploying using Swarm:
```
version: "3"

services:
  syncthing:
    image: "syncthing/syncthing:rc"
    ports:
      - 8384:8384
      - 22000:22000
      - 22000:22000/udp
      - 21027:21027/udp
    environment:
      - PUID=1200
      - PGID=1200
      - DOMAIN=<domain>
      - STGUIADDRESS=0.0.0.0:8384
    volumes:
      - /pool/docker_volumes/syncthing/config:/var/syncthing/config
      - /pool/syncthing/Data:/data
    networks:
      - traefik
    deploy:
      placement:
        constraints:
          - node.hostname==zfs-server
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik"
        - "traefik.http.routers.syncthing.rule=Host(`<domain>`)"
        - "traefik.http.services.syncthing.loadbalancer.server.port=8384"
        - "traefik.http.routers.syncthing.middlewares=authelia@file"

networks:
  traefik:
    external: true
```


Discussion / hints:
This looks more like a support request than a clear bug or feature request. Please use the forum - https://forum.syncthing.net/ - for support, first by searching for any similar issues and then by posting a new one when required. The forum has a lot more eyes and friendly people on it than the issue tracker.

Thanks!
This is either wrong or legit, but it's related to a recent change and merits investigation.
Legit:

```
jb@sep:~ % docker run syncthing/syncthing:rc
Unable to find image 'syncthing/syncthing:rc' locally
rc: Pulling from syncthing/syncthing
9b18e9b68314: Already exists
e73d203541b1: Already exists
096a2f4f4c93: Pull complete
7c7f4293d97e: Pull complete
Digest: sha256:f3f5e15c83f8b8f28a70f3d0f350294dd73a06a77082c0f3652567e83432d70e
Status: Downloaded newer image for syncthing/syncthing:rc
/bin/entrypoint.sh: line 7: PCAP: parameter not set
```
It's interesting though because I intended to prevent precisely this with the `ENV PCAP=` in the Dockerfile, and that works for me when testing locally, but it doesn't work in the actual published docker image. I suppose it may be because it gets built with an older Docker or something like that.
So this can be easily reproduced with this one-liner:
`set -u; if [ "$PCAP" == "" ] ; then echo foo; fi`

It's the `set -eu` at the start of the shell script, I'm keen to leave it as it's a nice sanity check for unset variables
We could set the fallback like this:

`set -u; if [ "${PCAP-}" == "" ] ; then echo foo; fi`
Which correctly defaults the variable to an empty string (which is just [parameter substitution](https://tldp.org/LDP/abs/html/parameter-substitution.html)) 

I can throw up a PR depending on which you'd like to do, remove `-u` or use substitution?
Yeah I'm on a fix as well currently, will file it shortly.

Fix patch:
diff --git a/Dockerfile b/Dockerfile
index 7c4913be67f..d201c0811c5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,7 +20,7 @@ RUN apk add --no-cache ca-certificates su-exec tzdata libcap
 COPY --from=builder /src/syncthing /bin/syncthing
 COPY --from=builder /src/script/docker-entrypoint.sh /bin/entrypoint.sh
 
-ENV PUID=1000 PGID=1000 HOME=/var/syncthing PCAP=
+ENV PUID=1000 PGID=1000 HOME=/var/syncthing
 
 HEALTHCHECK --interval=1m --timeout=10s \
   CMD nc -z 127.0.0.1 8384 || exit 1
diff --git a/script/docker-entrypoint.sh b/script/docker-entrypoint.sh
index f56817d1b51..e93e56306b0 100755
--- a/script/docker-entrypoint.sh
+++ b/script/docker-entrypoint.sh
@@ -4,7 +4,7 @@ set -eu
 
 if [ "$(id -u)" = '0' ]; then
   binary="$1"
-  if [ "$PCAP" == "" ] ; then
+  if [ "${PCAP:-}" == "" ] ; then
     # If Syncthing should have no extra capabilities, make sure to remove them
     # from the binary. This will fail with an error if there are no
     # capabilities to remove, hence the || true etc.


Test patch: