more cleanup to make WORKDIR write-only