fix(docker): bump dockerize to v0.15.2

[erikryanmoore]

Description & motivation

server/Dockerfile installs dockerize v0.10.1. That release pins golang.org/x/crypto v0.47.0 and golang.org/x/net v0.49.0. On temporalio/ui:2.56.0, Trivy 0.74.0 reports 16 high vulnerabilities with a fixed version in /usr/local/bin/dockerize. They are the only critical or high findings with a fix in the image: ui-server and the Alpine layer are clean.

dockerize v0.15.2 uses golang.org/x/crypto v0.57.0 and no longer depends on golang.org/x/net. Its go directive is 1.27.2, and the official golang images set GOTOOLCHAIN=local, so only the dockerize-builder stage moves to golang:1.27.2-alpine3.23. The server-builder and runtime stages are unchanged.

server/docker/README.md says dockerize templating is deprecated. If you prefer to remove dockerize now (#1703), that also clears these findings. This PR is the smallest change that keeps the legacy config-template path working.

Vulnerabilities in /usr/local/bin/dockerize that this removes:

• golang.org/x/crypto v0.47.0: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-56854
• golang.org/x/net v0.49.0: CVE-2026-25681, CVE-2026-27136, CVE-2026-33814, CVE-2026-39821, CVE-2026-46600, CVE-2026-78669

Testing

How was this tested

• Manual testing
• E2E tests added
• Unit tests added

I built the new dockerize-builder stage for linux/amd64 and copied its binary over /usr/local/bin/dockerize in temporalio/ui:2.56.0. Then:

• trivy image --scanners vuln --ignore-unfixed --severity CRITICAL,HIGH --exit-code 1 <image> exits 0. On stock temporalio/ui:2.56.0 it exits 1 with the 16 findings above.
• dockerize -template renders a {{ .Env.TEMPORAL_ADDRESS }} template with the value from the environment. A Sprig-style {{ env "X" | default "y" }} template renders the same output with v0.10.1 and v0.15.2.

I did not build the full image from a bare checkout, because server-builder embeds server/ui/assets from the frontend build.

Steps for others to test:

Build the image as your release pipeline does, then run trivy image --scanners vuln --ignore-unfixed --severity CRITICAL,HIGH --exit-code 1 <image> and docker run --rm --entrypoint dockerize <image> --help.

Checklists

Issue(s) closed

Addresses the dockerize findings in #3923.

Docs

Any docs updates needed?

No.

[vercel]

@erikryanmoore is attempting to deploy a commit to the Temporal Team on Vercel.

A member of the Team first needs to authorize it.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}