Insecure default docker umask (022)

[nijel]

The default umask settings for docker is 022 (which is also used by many distros)
https://github.com/docker/docker/pull/13941/files#diff-f12859176a0bd7f84e8c0884b1d71908R37
it's better to use more secure umask when possible, such as:
027
(none permissions for other)

The umask need to be set before creation of files that will remain in the image, thus affecting the permissions of extracted files (see issue above) & created files, such as: config.secret.inc.php.

Reported by Emanuel Bronshtein.