cleaner Dockerfile as heredoc rather than hacking with temp dir/file