Install patched glibc to workaround new syscalls not known to older Docker/runc

Dockerfile

 FROM archlinux:base-devel
 
+# Manually install patched glibc to workaround new system calls not known to Docker/runc
+RUN patched_glibc=glibc-linux4-2.33-4-x86_64.pkg.tar.zst && \
+    curl -LO "https://repo.archlinuxcn.org/x86_64/$patched_glibc" && \
+    bsdtar -C / -xvf "$patched_glibc"
+
 RUN set -x \
     && groupadd --gid 101 --system nginx \
     && useradd --uid 101 --gid nginx --system --create-home --home-dir /var/cache/nginx --shell /sbin/nologin nginx \
@@ -12,6 +17,7 @@ RUN set -x \
         && cd nginx-quic \
         && makepkg -scri --noconfirm \
     " \
+    && rm -f /etc/sudoers.d/nginx \
     && rm -rf /aur \
     && rm -rf /var/cache/pacman/pkg/*
 RUN openssl req -x509 -newkey rsa:4096 -days 365 -subj '/CN=localhost/O=localhost/C=US' \