issue: setcap build image shouldn't require a shell (#136633)

* issue: setcap build image shouldn't require a shell

* Apply review comment to rename intermediate binary

* Use plain `exec` rather than path to setcap executable.

build/server-image/kube-apiserver/Dockerfile

@@ -20,14 +20,15 @@ ARG SETCAP_IMAGE
 # to setup qemu for the builder.
 FROM --platform=linux/$BUILDARCH ${SETCAP_IMAGE}
 ARG BINARY
-COPY --chmod=755 ${BINARY} /${BINARY}
+COPY --chmod=755 ${BINARY} /binary_to_set
 # We apply cap_net_bind_service so that kube-apiserver can be run as
 # non-root and still listen on port less than 1024
-RUN setcap cap_net_bind_service=+ep /${BINARY}
+RUN ["setcap", "cap_net_bind_service=+ep", "/binary_to_set"]
 
 FROM --platform=linux/$TARGETARCH ${BASEIMAGE}
 ARG BINARY
-COPY --from=0 /${BINARY} /usr/local/bin/${BINARY}
+
+COPY --from=0 /binary_to_set /usr/local/bin/${BINARY}
 # NOTE: /go-runner is used here for compatibility
 COPY --chmod=755 kube-log-runner /go-runner
 ENTRYPOINT ["/go-runner"]