Can we instead change this to be `BUILDTAGS="$DOCKER_BUILDTAGS netgo"` and set `ENV DOCKER_BUILDTAGS apparmor` in our Dockerfile?  That way this will work as-is for all our packagers, and will also work as-is for our own build environment.