Superseded by #36259, which merged in 81dd43a and fixes #35472 with the same approach you took here — save the working directory before cd /opt/data and restore it before exec'ing the user's command, so Docker's -w flag is honored.

Thanks for the early fix @ilonagaja509-glitch — you spotted and solved this correctly. I went with #36259 because it was rebased onto current main (it uses the drop privilege-drop helper from #34837, which landed after this PR; this branch still had the older exec s6-setuidgid hermes hermes form), adds a HERMES_ORIG_CWD env override, and carries ordering-based regression tests.

Verified end-to-end before merge: on the old image docker run -w /workdir_1 … pwd returned /opt/data (the bug); after the fix it returns /workdir_1. Closing as superseded.