Fix jyq Dockerfile and rename to jyq.Dockerfile

- Rename Dockerfile.jyq -> jyq.Dockerfile for better IDE support
  (*.Dockerfile is the idiomatic naming for variant Dockerfiles)
- Fix jq runtime error: use alpine:3.21 as runtime stage instead of
  scratch with cherry-picked libraries (jq needs libonig.so.5 which
  was missing)
- Simplify Dockerfile: single alpine runtime stage with jq, yq, and
  ca-certificates installed via apk
- Update release.yml to reference jyq.Dockerfile
- Update CHANGELOG.md
Verified locally:
  docker build -f Dockerfile -> OK, initium --version works
  docker build -f jyq.Dockerfile -> OK, jq/yq/initium all work
  jq processes JSON correctly in container

Author: mikkeldamsgaard

.github/workflows/release.yml

@@ -51,7 +51,7 @@ jobs:
       - uses: docker/build-push-action@v6
         with:
           context: .
-          file: Dockerfile.jyq
+          file: jyq.Dockerfile
           platforms: linux/amd64,linux/arm64
           push: true
           build-args: |

CHANGELOG.md

@@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 - `exec` subcommand: run arbitrary commands with structured logging, exit code forwarding, and optional `--workdir` for child process working directory
-- `Dockerfile.jyq` and `initium-jyq` container image variant with pre-built `jq` and `yq` tools
+- `jyq.Dockerfile` and `initium-jyq` container image variant with pre-built `jq` and `yq` tools
 - Documentation for building custom images using Initium as a base
 - `fetch` subcommand and `internal/fetch` package: fetch secrets/config from HTTP(S) endpoints with auth header via env var, retry with backoff, TLS options, redirect control (same-site by default), and path traversal prevention
 - `render` subcommand and `internal/render` package: render templates into config files with `envsubst` (default) and Go `text/template` modes, path traversal prevention, and automatic intermediate directory creation

Dockerfile.jyq jyq.DockerfileDockerfile.jyq renamed to jyq.Dockerfile

@@ -12,20 +12,15 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
     go build -trimpath -ldflags="-s -w -X main.version=${VERSION}" \
     -o /initium ./cmd/initium
 
-FROM alpine:3.21 AS tools
+FROM alpine:3.21
 
-RUN apk add --no-cache jq yq
+RUN apk add --no-cache jq yq ca-certificates \
+    && rm -rf /var/cache/apk/*
 
-FROM scratch
-
-COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=builder /initium /initium
-COPY --from=tools /usr/bin/jq /usr/bin/jq
-COPY --from=tools /usr/bin/yq /usr/bin/yq
-COPY --from=tools /lib/ld-musl-* /lib/
-COPY --from=tools /usr/lib/libintl* /usr/lib/
 
 USER 65534:65534
 
 ENTRYPOINT ["/initium"]
 
+