every command in a dockerfile introduces a new layer and thus a `RUN chown` creates a copy of the file