diff --git a/apache-tomcat-10-image/Dockerfile.openjdk17 b/apache-tomcat-10-image/Dockerfile.openjdk17
index 89fee4e24..043d2425b 100644
--- a/apache-tomcat-10-image/Dockerfile.openjdk17
+++ b/apache-tomcat-10-image/Dockerfile.openjdk17
@@ -25,7 +25,7 @@ FROM opensuse/tumbleweed:latest AS builder
 COPY --from=target / /target
 
 RUN set -euo pipefail; \
-    zypper -n --installroot /target --gpg-auto-import-keys install --no-recommends tomcat10 curl sed java-17-openjdk java-17-openjdk-headless; \
+    zypper -n --installroot /target --gpg-auto-import-keys install --no-recommends tomcat10 java-17-openjdk java-17-openjdk-headless; \
     zypper -n --installroot /target remove util-linux; \
     zypper -n clean; \
     rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}
@@ -58,11 +58,14 @@ CMD ["/usr/libexec/tomcat/server", "start"]
 EXPOSE 8080/tcp
 RUN set -euo pipefail; mkdir -p /var/log/tomcat; chown --recursive tomcat:tomcat /var/log/tomcat
 RUN set -euo pipefail; ln -s /usr/share/tomcat /usr/local/tomcat
-RUN set -euo pipefail; \
-    sed -i /etc/tomcat/logging.properties \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = java.util.logging.ConsoleHandler|' \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[/manager\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = java.util.logging.ConsoleHandler|' \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[/host-manager\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = java.util.logging.ConsoleHandler|'
+RUN set -euo pipefail; while IFS= read -r line; do \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = java.util.logging.ConsoleHandler}; \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[\/manager\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = java.util.logging.ConsoleHandler}; \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[\/host-manager\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = java.util.logging.ConsoleHandler}; \
+  echo "$line" >> /tmp/logging.properties; \
+done < /usr/share/tomcat/conf/logging.properties; \
+
+mv /tmp/logging.properties /usr/share/tomcat/conf/logging.properties
 
 WORKDIR $CATALINA_HOME
 USER tomcat
diff --git a/apache-tomcat-10-image/Dockerfile.openjdk21 b/apache-tomcat-10-image/Dockerfile.openjdk21
index 51c193541..ad4917493 100644
--- a/apache-tomcat-10-image/Dockerfile.openjdk21
+++ b/apache-tomcat-10-image/Dockerfile.openjdk21
@@ -25,7 +25,7 @@ FROM opensuse/tumbleweed:latest AS builder
 COPY --from=target / /target
 
 RUN set -euo pipefail; \
-    zypper -n --installroot /target --gpg-auto-import-keys install --no-recommends tomcat10 curl sed java-21-openjdk java-21-openjdk-headless; \
+    zypper -n --installroot /target --gpg-auto-import-keys install --no-recommends tomcat10 java-21-openjdk java-21-openjdk-headless; \
     zypper -n --installroot /target remove util-linux; \
     zypper -n clean; \
     rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}
@@ -58,11 +58,14 @@ CMD ["/usr/libexec/tomcat/server", "start"]
 EXPOSE 8080/tcp
 RUN set -euo pipefail; mkdir -p /var/log/tomcat; chown --recursive tomcat:tomcat /var/log/tomcat
 RUN set -euo pipefail; ln -s /usr/share/tomcat /usr/local/tomcat
-RUN set -euo pipefail; \
-    sed -i /etc/tomcat/logging.properties \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = java.util.logging.ConsoleHandler|' \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[/manager\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = java.util.logging.ConsoleHandler|' \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[/host-manager\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = java.util.logging.ConsoleHandler|'
+RUN set -euo pipefail; while IFS= read -r line; do \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = java.util.logging.ConsoleHandler}; \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[\/manager\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = java.util.logging.ConsoleHandler}; \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[\/host-manager\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = java.util.logging.ConsoleHandler}; \
+  echo "$line" >> /tmp/logging.properties; \
+done < /usr/share/tomcat/conf/logging.properties; \
+
+mv /tmp/logging.properties /usr/share/tomcat/conf/logging.properties
 
 WORKDIR $CATALINA_HOME
 USER tomcat
diff --git a/apache-tomcat-10-image/Dockerfile.openjdk23 b/apache-tomcat-10-image/Dockerfile.openjdk23
index f618c9d6a..f899bc5ba 100644
--- a/apache-tomcat-10-image/Dockerfile.openjdk23
+++ b/apache-tomcat-10-image/Dockerfile.openjdk23
@@ -25,7 +25,7 @@ FROM opensuse/tumbleweed:latest AS builder
 COPY --from=target / /target
 
 RUN set -euo pipefail; \
-    zypper -n --installroot /target --gpg-auto-import-keys install --no-recommends tomcat10 curl sed java-23-openjdk java-23-openjdk-headless; \
+    zypper -n --installroot /target --gpg-auto-import-keys install --no-recommends tomcat10 java-23-openjdk java-23-openjdk-headless; \
     zypper -n --installroot /target remove util-linux; \
     zypper -n clean; \
     rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}
@@ -58,11 +58,14 @@ CMD ["/usr/libexec/tomcat/server", "start"]
 EXPOSE 8080/tcp
 RUN set -euo pipefail; mkdir -p /var/log/tomcat; chown --recursive tomcat:tomcat /var/log/tomcat
 RUN set -euo pipefail; ln -s /usr/share/tomcat /usr/local/tomcat
-RUN set -euo pipefail; \
-    sed -i /etc/tomcat/logging.properties \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = java.util.logging.ConsoleHandler|' \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[/manager\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = java.util.logging.ConsoleHandler|' \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[/host-manager\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = java.util.logging.ConsoleHandler|'
+RUN set -euo pipefail; while IFS= read -r line; do \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = java.util.logging.ConsoleHandler}; \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[\/manager\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = java.util.logging.ConsoleHandler}; \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[\/host-manager\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = java.util.logging.ConsoleHandler}; \
+  echo "$line" >> /tmp/logging.properties; \
+done < /usr/share/tomcat/conf/logging.properties; \
+
+mv /tmp/logging.properties /usr/share/tomcat/conf/logging.properties
 
 WORKDIR $CATALINA_HOME
 USER tomcat
diff --git a/apache-tomcat-9-image/Dockerfile.openjdk17 b/apache-tomcat-9-image/Dockerfile.openjdk17
index 7c28e706c..114875723 100644
--- a/apache-tomcat-9-image/Dockerfile.openjdk17
+++ b/apache-tomcat-9-image/Dockerfile.openjdk17
@@ -25,7 +25,7 @@ FROM opensuse/tumbleweed:latest AS builder
 COPY --from=target / /target
 
 RUN set -euo pipefail; \
-    zypper -n --installroot /target --gpg-auto-import-keys install --no-recommends tomcat curl sed java-17-openjdk java-17-openjdk-headless; \
+    zypper -n --installroot /target --gpg-auto-import-keys install --no-recommends tomcat java-17-openjdk java-17-openjdk-headless; \
     zypper -n --installroot /target remove util-linux; \
     zypper -n clean; \
     rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}
@@ -58,11 +58,14 @@ CMD ["/usr/libexec/tomcat/server", "start"]
 EXPOSE 8080/tcp
 RUN set -euo pipefail; mkdir -p /var/log/tomcat; chown --recursive tomcat:tomcat /var/log/tomcat
 RUN set -euo pipefail; ln -s /usr/share/tomcat /usr/local/tomcat
-RUN set -euo pipefail; \
-    sed -i /etc/tomcat/logging.properties \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = java.util.logging.ConsoleHandler|' \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[/manager\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = java.util.logging.ConsoleHandler|' \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[/host-manager\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = java.util.logging.ConsoleHandler|'
+RUN set -euo pipefail; while IFS= read -r line; do \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = java.util.logging.ConsoleHandler}; \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[\/manager\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = java.util.logging.ConsoleHandler}; \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[\/host-manager\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = java.util.logging.ConsoleHandler}; \
+  echo "$line" >> /tmp/logging.properties; \
+done < /usr/share/tomcat/conf/logging.properties; \
+
+mv /tmp/logging.properties /usr/share/tomcat/conf/logging.properties
 
 WORKDIR $CATALINA_HOME
 USER tomcat
diff --git a/apache-tomcat-9-image/Dockerfile.openjdk21 b/apache-tomcat-9-image/Dockerfile.openjdk21
index bcc3f0df4..f79e07996 100644
--- a/apache-tomcat-9-image/Dockerfile.openjdk21
+++ b/apache-tomcat-9-image/Dockerfile.openjdk21
@@ -25,7 +25,7 @@ FROM opensuse/tumbleweed:latest AS builder
 COPY --from=target / /target
 
 RUN set -euo pipefail; \
-    zypper -n --installroot /target --gpg-auto-import-keys install --no-recommends tomcat curl sed java-21-openjdk java-21-openjdk-headless; \
+    zypper -n --installroot /target --gpg-auto-import-keys install --no-recommends tomcat java-21-openjdk java-21-openjdk-headless; \
     zypper -n --installroot /target remove util-linux; \
     zypper -n clean; \
     rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}
@@ -58,11 +58,14 @@ CMD ["/usr/libexec/tomcat/server", "start"]
 EXPOSE 8080/tcp
 RUN set -euo pipefail; mkdir -p /var/log/tomcat; chown --recursive tomcat:tomcat /var/log/tomcat
 RUN set -euo pipefail; ln -s /usr/share/tomcat /usr/local/tomcat
-RUN set -euo pipefail; \
-    sed -i /etc/tomcat/logging.properties \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = java.util.logging.ConsoleHandler|' \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[/manager\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = java.util.logging.ConsoleHandler|' \
-        -e 's|org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[/host-manager\]\.handlers =.*|org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = java.util.logging.ConsoleHandler|'
+RUN set -euo pipefail; while IFS= read -r line; do \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = java.util.logging.ConsoleHandler}; \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[\/manager\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = java.util.logging.ConsoleHandler}; \
+  line=${line/org\.apache\.catalina\.core\.ContainerBase\.\[Catalina\]\.\[localhost\]\.\[\/host-manager\]\.handlers =*/org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = java.util.logging.ConsoleHandler}; \
+  echo "$line" >> /tmp/logging.properties; \
+done < /usr/share/tomcat/conf/logging.properties; \
+
+mv /tmp/logging.properties /usr/share/tomcat/conf/logging.properties
 
 WORKDIR $CATALINA_HOME
 USER tomcat
diff --git a/mariadb-image/Dockerfile b/mariadb-image/Dockerfile
index 5cda25e80..622377c5e 100644
--- a/mariadb-image/Dockerfile
+++ b/mariadb-image/Dockerfile
@@ -64,8 +64,12 @@ RUN set -euo pipefail; ln -s usr/local/bin/docker-entrypoint.sh / # backwards co
 COPY healthcheck.sh /usr/local/bin/
 RUN set -euo pipefail; chmod 755 /usr/local/bin/healthcheck.sh
 
-COPY gosu /usr/local/bin/gosu
-RUN set -euo pipefail; chmod 755 /usr/local/bin/gosu
+COPY idexec /usr/local/bin/idexec
+RUN set -euo pipefail; chmod 755 /usr/local/bin/idexec
+
+# replace gosu calls with idexec
+RUN set -euo pipefail; sed -i 's/exec gosu /exec idexec /g' /usr/local/bin/docker-entrypoint.sh
+RUN set -euo pipefail; sed -i 's/exec gosu /exec idexec /g' /usr/local/bin/healthcheck.sh
 
 RUN set -euo pipefail; sed -i -e 's,$(pwgen .*),$(openssl rand -base64 36),' /usr/local/bin/docker-entrypoint.sh
 
diff --git a/mariadb-image/gosu b/mariadb-image/idexec
similarity index 100%
rename from mariadb-image/gosu
rename to mariadb-image/idexec