diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..13752d41
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+/*/**/Dockerfile      linguist-generated
+/Dockerfile.template  linguist-language=Dockerfile
diff --git a/.github/workflows/verify-templating.yml b/.github/workflows/verify-templating.yml
new file mode 100644
index 00000000..7e833f1c
--- /dev/null
+++ b/.github/workflows/verify-templating.yml
@@ -0,0 +1,22 @@
+name: Verify Templating
+
+on:
+  pull_request:
+  push:
+
+defaults:
+  run:
+    shell: 'bash -Eeuo pipefail -x {0}'
+
+jobs:
+  apply-templates:
+    name: Check For Uncomitted Changes
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Apply Templates
+        run: ./apply-templates.sh
+      - name: Check Git Status
+        run: |
+          status="$(git status --short)"
+          [ -z "$status" ]
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 00000000..d548f66d
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.jq-template.awk
diff --git a/1.7/Dockerfile b/1.7/Dockerfile
index 781925ec..6ac23f80 100644
--- a/1.7/Dockerfile
+++ b/1.7/Dockerfile
@@ -1,4 +1,9 @@
-# vim:set ft=dockerfile:
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM debian:buster-slim
 
 # roughly, https://salsa.debian.org/haproxy-team/haproxy/-/blob/732b97ae286906dea19ab5744cf9cf97c364ac1d/debian/haproxy.postinst#L5-6
@@ -74,7 +79,10 @@ RUN set -eux; \
 		| sort -u \
 		| xargs -r apt-mark manual \
 	; \
-	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+	\
+# smoke test
+	haproxy -v
 
 # https://www.haproxy.org/download/1.8/doc/management.txt
 # "4. Stopping and restarting HAProxy"
@@ -86,4 +94,5 @@ COPY docker-entrypoint.sh /usr/local/bin/
 RUN ln -s usr/local/bin/docker-entrypoint.sh / # backwards compat
 ENTRYPOINT ["docker-entrypoint.sh"]
 
+# no USER for backwards compatibility (to try to avoid breaking existing users)
 CMD ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
diff --git a/1.7/alpine/Dockerfile b/1.7/alpine/Dockerfile
index a1f65902..33d03ac7 100644
--- a/1.7/alpine/Dockerfile
+++ b/1.7/alpine/Dockerfile
@@ -1,4 +1,9 @@
-# vim:set ft=dockerfile:
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM alpine:3.12
 
 # roughly, https://git.alpinelinux.org/aports/tree/main/haproxy/haproxy.pre-install?h=3.12-stable
@@ -18,9 +23,9 @@ ENV HAPROXY_URL https://www.haproxy.org/download/1.7/src/haproxy-1.7.12.tar.gz
 ENV HAPROXY_SHA256 4118178b553a107b227f3f84774c7a50ae0b3ac2be39211c3db511ed4efe48ce
 
 # see https://sources.debian.net/src/haproxy/jessie/debian/rules/ for some helpful navigation of the possible "make" arguments
-RUN set -x \
+RUN set -eux; \
 	\
-	&& apk add --no-cache --virtual .build-deps \
+	apk add --no-cache --virtual .build-deps \
 		gcc \
 		libc-dev \
 		linux-headers \
@@ -32,14 +37,15 @@ RUN set -x \
 		readline-dev \
 		tar \
 		zlib-dev \
+	; \
 	\
-	&& wget -O haproxy.tar.gz "$HAPROXY_URL" \
-	&& echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c \
-	&& mkdir -p /usr/src/haproxy \
-	&& tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1 \
-	&& rm haproxy.tar.gz \
+	wget -O haproxy.tar.gz "$HAPROXY_URL"; \
+	echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c; \
+	mkdir -p /usr/src/haproxy; \
+	tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1; \
+	rm haproxy.tar.gz; \
 	\
-	&& makeOpts=' \
+	makeOpts=' \
 		CFLAGS+="-Wno-address-of-packed-member" \
 		TARGET=linux2628 \
 		USE_GETADDRINFO=1 \
@@ -50,23 +56,27 @@ RUN set -x \
 		\
 		EXTRA_OBJS=" \
 		" \
-	' \
-	&& nproc="$(getconf _NPROCESSORS_ONLN)" \
-	&& eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts" \
-	&& eval "make -C /usr/src/haproxy install-bin $makeOpts" \
+	'; \
 	\
-	&& mkdir -p /usr/local/etc/haproxy \
-	&& cp -R /usr/src/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors \
-	&& rm -rf /usr/src/haproxy \
+	nproc="$(getconf _NPROCESSORS_ONLN)"; \
+	eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts"; \
+	eval "make -C /usr/src/haproxy install-bin $makeOpts"; \
 	\
-	&& runDeps="$( \
+	mkdir -p /usr/local/etc/haproxy; \
+	cp -R /usr/src/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors; \
+	rm -rf /usr/src/haproxy; \
+	\
+	runDeps="$( \
 		scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
 			| tr ',' '\n' \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
-	)" \
-	&& apk add --no-network --virtual .haproxy-rundeps $runDeps \
-	&& apk del --no-network .build-deps
+	)"; \
+	apk add --no-network --virtual .haproxy-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
+	\
+# smoke test
+	haproxy -v
 
 # https://www.haproxy.org/download/1.8/doc/management.txt
 # "4. Stopping and restarting HAProxy"
@@ -78,4 +88,5 @@ COPY docker-entrypoint.sh /usr/local/bin/
 RUN ln -s usr/local/bin/docker-entrypoint.sh / # backwards compat
 ENTRYPOINT ["docker-entrypoint.sh"]
 
+# no USER for backwards compatibility (to try to avoid breaking existing users)
 CMD ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
diff --git a/1.8/Dockerfile b/1.8/Dockerfile
index e62c747f..f8c048c4 100644
--- a/1.8/Dockerfile
+++ b/1.8/Dockerfile
@@ -1,4 +1,9 @@
-# vim:set ft=dockerfile:
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM debian:buster-slim
 
 # roughly, https://salsa.debian.org/haproxy-team/haproxy/-/blob/732b97ae286906dea19ab5744cf9cf97c364ac1d/debian/haproxy.postinst#L5-6
@@ -74,7 +79,10 @@ RUN set -eux; \
 		| sort -u \
 		| xargs -r apt-mark manual \
 	; \
-	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+	\
+# smoke test
+	haproxy -v
 
 # https://www.haproxy.org/download/1.8/doc/management.txt
 # "4. Stopping and restarting HAProxy"
@@ -86,4 +94,5 @@ COPY docker-entrypoint.sh /usr/local/bin/
 RUN ln -s usr/local/bin/docker-entrypoint.sh / # backwards compat
 ENTRYPOINT ["docker-entrypoint.sh"]
 
+# no USER for backwards compatibility (to try to avoid breaking existing users)
 CMD ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
diff --git a/1.8/alpine/Dockerfile b/1.8/alpine/Dockerfile
index e0b78c0d..b6248a1a 100644
--- a/1.8/alpine/Dockerfile
+++ b/1.8/alpine/Dockerfile
@@ -1,4 +1,9 @@
-# vim:set ft=dockerfile:
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM alpine:3.13
 
 # roughly, https://git.alpinelinux.org/aports/tree/main/haproxy/haproxy.pre-install?h=3.12-stable
@@ -18,9 +23,9 @@ ENV HAPROXY_URL https://www.haproxy.org/download/1.8/src/haproxy-1.8.29.tar.gz
 ENV HAPROXY_SHA256 a91777252bd655413411b832fbce7bb3a27b0484b498e2c614c405e12f53a764
 
 # see https://sources.debian.net/src/haproxy/jessie/debian/rules/ for some helpful navigation of the possible "make" arguments
-RUN set -x \
+RUN set -eux; \
 	\
-	&& apk add --no-cache --virtual .build-deps \
+	apk add --no-cache --virtual .build-deps \
 		gcc \
 		libc-dev \
 		linux-headers \
@@ -32,14 +37,15 @@ RUN set -x \
 		readline-dev \
 		tar \
 		zlib-dev \
+	; \
 	\
-	&& wget -O haproxy.tar.gz "$HAPROXY_URL" \
-	&& echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c \
-	&& mkdir -p /usr/src/haproxy \
-	&& tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1 \
-	&& rm haproxy.tar.gz \
+	wget -O haproxy.tar.gz "$HAPROXY_URL"; \
+	echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c; \
+	mkdir -p /usr/src/haproxy; \
+	tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1; \
+	rm haproxy.tar.gz; \
 	\
-	&& makeOpts=' \
+	makeOpts=' \
 		TARGET=linux2628 \
 		USE_GETADDRINFO=1 \
 		USE_LUA=1 LUA_INC=/usr/include/lua5.3 LUA_LIB=/usr/lib/lua5.3 \
@@ -49,23 +55,27 @@ RUN set -x \
 		\
 		EXTRA_OBJS=" \
 		" \
-	' \
-	&& nproc="$(getconf _NPROCESSORS_ONLN)" \
-	&& eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts" \
-	&& eval "make -C /usr/src/haproxy install-bin $makeOpts" \
+	'; \
 	\
-	&& mkdir -p /usr/local/etc/haproxy \
-	&& cp -R /usr/src/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors \
-	&& rm -rf /usr/src/haproxy \
+	nproc="$(getconf _NPROCESSORS_ONLN)"; \
+	eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts"; \
+	eval "make -C /usr/src/haproxy install-bin $makeOpts"; \
 	\
-	&& runDeps="$( \
+	mkdir -p /usr/local/etc/haproxy; \
+	cp -R /usr/src/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors; \
+	rm -rf /usr/src/haproxy; \
+	\
+	runDeps="$( \
 		scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
 			| tr ',' '\n' \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
-	)" \
-	&& apk add --no-network --virtual .haproxy-rundeps $runDeps \
-	&& apk del --no-network .build-deps
+	)"; \
+	apk add --no-network --virtual .haproxy-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
+	\
+# smoke test
+	haproxy -v
 
 # https://www.haproxy.org/download/1.8/doc/management.txt
 # "4. Stopping and restarting HAProxy"
@@ -77,4 +87,5 @@ COPY docker-entrypoint.sh /usr/local/bin/
 RUN ln -s usr/local/bin/docker-entrypoint.sh / # backwards compat
 ENTRYPOINT ["docker-entrypoint.sh"]
 
+# no USER for backwards compatibility (to try to avoid breaking existing users)
 CMD ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
diff --git a/2.0/Dockerfile b/2.0/Dockerfile
index 2edcbc60..6808f4d6 100644
--- a/2.0/Dockerfile
+++ b/2.0/Dockerfile
@@ -1,4 +1,9 @@
-# vim:set ft=dockerfile:
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM debian:buster-slim
 
 # roughly, https://salsa.debian.org/haproxy-team/haproxy/-/blob/732b97ae286906dea19ab5744cf9cf97c364ac1d/debian/haproxy.postinst#L5-6
@@ -76,7 +81,10 @@ RUN set -eux; \
 		| sort -u \
 		| xargs -r apt-mark manual \
 	; \
-	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+	\
+# smoke test
+	haproxy -v
 
 # https://www.haproxy.org/download/1.8/doc/management.txt
 # "4. Stopping and restarting HAProxy"
@@ -88,4 +96,5 @@ COPY docker-entrypoint.sh /usr/local/bin/
 RUN ln -s usr/local/bin/docker-entrypoint.sh / # backwards compat
 ENTRYPOINT ["docker-entrypoint.sh"]
 
+# no USER for backwards compatibility (to try to avoid breaking existing users)
 CMD ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
diff --git a/2.0/alpine/Dockerfile b/2.0/alpine/Dockerfile
index d1c27ed2..f257c4df 100644
--- a/2.0/alpine/Dockerfile
+++ b/2.0/alpine/Dockerfile
@@ -1,4 +1,9 @@
-# vim:set ft=dockerfile:
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM alpine:3.13
 
 # roughly, https://git.alpinelinux.org/aports/tree/main/haproxy/haproxy.pre-install?h=3.12-stable
@@ -18,9 +23,9 @@ ENV HAPROXY_URL https://www.haproxy.org/download/2.0/src/haproxy-2.0.21.tar.gz
 ENV HAPROXY_SHA256 9823fd0e33d77827538edc3ac86fb5d5c099e63350bdafc3beaa2632491a0132
 
 # see https://sources.debian.net/src/haproxy/jessie/debian/rules/ for some helpful navigation of the possible "make" arguments
-RUN set -x \
+RUN set -eux; \
 	\
-	&& apk add --no-cache --virtual .build-deps \
+	apk add --no-cache --virtual .build-deps \
 		gcc \
 		libc-dev \
 		linux-headers \
@@ -32,14 +37,15 @@ RUN set -x \
 		readline-dev \
 		tar \
 		zlib-dev \
+	; \
 	\
-	&& wget -O haproxy.tar.gz "$HAPROXY_URL" \
-	&& echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c \
-	&& mkdir -p /usr/src/haproxy \
-	&& tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1 \
-	&& rm haproxy.tar.gz \
+	wget -O haproxy.tar.gz "$HAPROXY_URL"; \
+	echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c; \
+	mkdir -p /usr/src/haproxy; \
+	tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1; \
+	rm haproxy.tar.gz; \
 	\
-	&& makeOpts=' \
+	makeOpts=' \
 		TARGET=linux-glibc \
 		USE_GETADDRINFO=1 \
 		USE_LUA=1 LUA_INC=/usr/include/lua5.3 LUA_LIB=/usr/lib/lua5.3 \
@@ -51,23 +57,27 @@ RUN set -x \
 # see https://github.com/docker-library/haproxy/issues/94#issuecomment-505673353 for more details about prometheus support
 			contrib/prometheus-exporter/service-prometheus.o \
 		" \
-	' \
-	&& nproc="$(getconf _NPROCESSORS_ONLN)" \
-	&& eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts" \
-	&& eval "make -C /usr/src/haproxy install-bin $makeOpts" \
+	'; \
 	\
-	&& mkdir -p /usr/local/etc/haproxy \
-	&& cp -R /usr/src/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors \
-	&& rm -rf /usr/src/haproxy \
+	nproc="$(getconf _NPROCESSORS_ONLN)"; \
+	eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts"; \
+	eval "make -C /usr/src/haproxy install-bin $makeOpts"; \
 	\
-	&& runDeps="$( \
+	mkdir -p /usr/local/etc/haproxy; \
+	cp -R /usr/src/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors; \
+	rm -rf /usr/src/haproxy; \
+	\
+	runDeps="$( \
 		scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
 			| tr ',' '\n' \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
-	)" \
-	&& apk add --no-network --virtual .haproxy-rundeps $runDeps \
-	&& apk del --no-network .build-deps
+	)"; \
+	apk add --no-network --virtual .haproxy-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
+	\
+# smoke test
+	haproxy -v
 
 # https://www.haproxy.org/download/1.8/doc/management.txt
 # "4. Stopping and restarting HAProxy"
@@ -79,4 +89,5 @@ COPY docker-entrypoint.sh /usr/local/bin/
 RUN ln -s usr/local/bin/docker-entrypoint.sh / # backwards compat
 ENTRYPOINT ["docker-entrypoint.sh"]
 
+# no USER for backwards compatibility (to try to avoid breaking existing users)
 CMD ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
diff --git a/2.2/Dockerfile b/2.2/Dockerfile
index f0182e33..f6d6c0fb 100644
--- a/2.2/Dockerfile
+++ b/2.2/Dockerfile
@@ -1,4 +1,9 @@
-# vim:set ft=dockerfile:
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM debian:buster-slim
 
 # roughly, https://salsa.debian.org/haproxy-team/haproxy/-/blob/732b97ae286906dea19ab5744cf9cf97c364ac1d/debian/haproxy.postinst#L5-6
@@ -76,7 +81,10 @@ RUN set -eux; \
 		| sort -u \
 		| xargs -r apt-mark manual \
 	; \
-	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+	\
+# smoke test
+	haproxy -v
 
 # https://www.haproxy.org/download/1.8/doc/management.txt
 # "4. Stopping and restarting HAProxy"
@@ -88,4 +96,5 @@ COPY docker-entrypoint.sh /usr/local/bin/
 RUN ln -s usr/local/bin/docker-entrypoint.sh / # backwards compat
 ENTRYPOINT ["docker-entrypoint.sh"]
 
+# no USER for backwards compatibility (to try to avoid breaking existing users)
 CMD ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
diff --git a/2.2/alpine/Dockerfile b/2.2/alpine/Dockerfile
index 70961f4d..34ca5e86 100644
--- a/2.2/alpine/Dockerfile
+++ b/2.2/alpine/Dockerfile
@@ -1,4 +1,9 @@
-# vim:set ft=dockerfile:
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM alpine:3.13
 
 # roughly, https://git.alpinelinux.org/aports/tree/main/haproxy/haproxy.pre-install?h=3.12-stable
@@ -18,9 +23,9 @@ ENV HAPROXY_URL https://www.haproxy.org/download/2.2/src/haproxy-2.2.11.tar.gz
 ENV HAPROXY_SHA256 173a98506472bb1ba5a4a7f3a281125163f78bab5793bf6ba1f1d50853eb5f23
 
 # see https://sources.debian.net/src/haproxy/jessie/debian/rules/ for some helpful navigation of the possible "make" arguments
-RUN set -x \
+RUN set -eux; \
 	\
-	&& apk add --no-cache --virtual .build-deps \
+	apk add --no-cache --virtual .build-deps \
 		gcc \
 		libc-dev \
 		linux-headers \
@@ -32,14 +37,15 @@ RUN set -x \
 		readline-dev \
 		tar \
 		zlib-dev \
+	; \
 	\
-	&& wget -O haproxy.tar.gz "$HAPROXY_URL" \
-	&& echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c \
-	&& mkdir -p /usr/src/haproxy \
-	&& tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1 \
-	&& rm haproxy.tar.gz \
+	wget -O haproxy.tar.gz "$HAPROXY_URL"; \
+	echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c; \
+	mkdir -p /usr/src/haproxy; \
+	tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1; \
+	rm haproxy.tar.gz; \
 	\
-	&& makeOpts=' \
+	makeOpts=' \
 		TARGET=linux-musl \
 		USE_GETADDRINFO=1 \
 		USE_LUA=1 LUA_INC=/usr/include/lua5.3 LUA_LIB=/usr/lib/lua5.3 \
@@ -51,23 +57,27 @@ RUN set -x \
 # see https://github.com/docker-library/haproxy/issues/94#issuecomment-505673353 for more details about prometheus support
 			contrib/prometheus-exporter/service-prometheus.o \
 		" \
-	' \
-	&& nproc="$(getconf _NPROCESSORS_ONLN)" \
-	&& eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts" \
-	&& eval "make -C /usr/src/haproxy install-bin $makeOpts" \
+	'; \
 	\
-	&& mkdir -p /usr/local/etc/haproxy \
-	&& cp -R /usr/src/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors \
-	&& rm -rf /usr/src/haproxy \
+	nproc="$(getconf _NPROCESSORS_ONLN)"; \
+	eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts"; \
+	eval "make -C /usr/src/haproxy install-bin $makeOpts"; \
 	\
-	&& runDeps="$( \
+	mkdir -p /usr/local/etc/haproxy; \
+	cp -R /usr/src/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors; \
+	rm -rf /usr/src/haproxy; \
+	\
+	runDeps="$( \
 		scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
 			| tr ',' '\n' \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
-	)" \
-	&& apk add --no-network --virtual .haproxy-rundeps $runDeps \
-	&& apk del --no-network .build-deps
+	)"; \
+	apk add --no-network --virtual .haproxy-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
+	\
+# smoke test
+	haproxy -v
 
 # https://www.haproxy.org/download/1.8/doc/management.txt
 # "4. Stopping and restarting HAProxy"
@@ -79,4 +89,5 @@ COPY docker-entrypoint.sh /usr/local/bin/
 RUN ln -s usr/local/bin/docker-entrypoint.sh / # backwards compat
 ENTRYPOINT ["docker-entrypoint.sh"]
 
+# no USER for backwards compatibility (to try to avoid breaking existing users)
 CMD ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
diff --git a/2.3/Dockerfile b/2.3/Dockerfile
index e979a254..09873cf2 100644
--- a/2.3/Dockerfile
+++ b/2.3/Dockerfile
@@ -1,4 +1,9 @@
-# vim:set ft=dockerfile:
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM debian:buster-slim
 
 # roughly, https://salsa.debian.org/haproxy-team/haproxy/-/blob/732b97ae286906dea19ab5744cf9cf97c364ac1d/debian/haproxy.postinst#L5-6
@@ -76,7 +81,10 @@ RUN set -eux; \
 		| sort -u \
 		| xargs -r apt-mark manual \
 	; \
-	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+	\
+# smoke test
+	haproxy -v
 
 # https://www.haproxy.org/download/1.8/doc/management.txt
 # "4. Stopping and restarting HAProxy"
@@ -88,4 +96,5 @@ COPY docker-entrypoint.sh /usr/local/bin/
 RUN ln -s usr/local/bin/docker-entrypoint.sh / # backwards compat
 ENTRYPOINT ["docker-entrypoint.sh"]
 
+# no USER for backwards compatibility (to try to avoid breaking existing users)
 CMD ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
diff --git a/2.3/alpine/Dockerfile b/2.3/alpine/Dockerfile
index a3ed622c..f297ee8d 100644
--- a/2.3/alpine/Dockerfile
+++ b/2.3/alpine/Dockerfile
@@ -1,4 +1,9 @@
-# vim:set ft=dockerfile:
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM alpine:3.13
 
 # roughly, https://git.alpinelinux.org/aports/tree/main/haproxy/haproxy.pre-install?h=3.12-stable
@@ -18,9 +23,9 @@ ENV HAPROXY_URL https://www.haproxy.org/download/2.3/src/haproxy-2.3.8.tar.gz
 ENV HAPROXY_SHA256 2aa2691238dbe6360318673603aecd1041df19d55447172f8cd988780788159c
 
 # see https://sources.debian.net/src/haproxy/jessie/debian/rules/ for some helpful navigation of the possible "make" arguments
-RUN set -x \
+RUN set -eux; \
 	\
-	&& apk add --no-cache --virtual .build-deps \
+	apk add --no-cache --virtual .build-deps \
 		gcc \
 		libc-dev \
 		linux-headers \
@@ -32,14 +37,15 @@ RUN set -x \
 		readline-dev \
 		tar \
 		zlib-dev \
+	; \
 	\
-	&& wget -O haproxy.tar.gz "$HAPROXY_URL" \
-	&& echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c \
-	&& mkdir -p /usr/src/haproxy \
-	&& tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1 \
-	&& rm haproxy.tar.gz \
+	wget -O haproxy.tar.gz "$HAPROXY_URL"; \
+	echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c; \
+	mkdir -p /usr/src/haproxy; \
+	tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1; \
+	rm haproxy.tar.gz; \
 	\
-	&& makeOpts=' \
+	makeOpts=' \
 		TARGET=linux-musl \
 		USE_GETADDRINFO=1 \
 		USE_LUA=1 LUA_INC=/usr/include/lua5.3 LUA_LIB=/usr/lib/lua5.3 \
@@ -51,23 +57,27 @@ RUN set -x \
 # see https://github.com/docker-library/haproxy/issues/94#issuecomment-505673353 for more details about prometheus support
 			contrib/prometheus-exporter/service-prometheus.o \
 		" \
-	' \
-	&& nproc="$(getconf _NPROCESSORS_ONLN)" \
-	&& eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts" \
-	&& eval "make -C /usr/src/haproxy install-bin $makeOpts" \
+	'; \
 	\
-	&& mkdir -p /usr/local/etc/haproxy \
-	&& cp -R /usr/src/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors \
-	&& rm -rf /usr/src/haproxy \
+	nproc="$(getconf _NPROCESSORS_ONLN)"; \
+	eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts"; \
+	eval "make -C /usr/src/haproxy install-bin $makeOpts"; \
 	\
-	&& runDeps="$( \
+	mkdir -p /usr/local/etc/haproxy; \
+	cp -R /usr/src/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors; \
+	rm -rf /usr/src/haproxy; \
+	\
+	runDeps="$( \
 		scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
 			| tr ',' '\n' \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
-	)" \
-	&& apk add --no-network --virtual .haproxy-rundeps $runDeps \
-	&& apk del --no-network .build-deps
+	)"; \
+	apk add --no-network --virtual .haproxy-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
+	\
+# smoke test
+	haproxy -v
 
 # https://www.haproxy.org/download/1.8/doc/management.txt
 # "4. Stopping and restarting HAProxy"
@@ -79,4 +89,5 @@ COPY docker-entrypoint.sh /usr/local/bin/
 RUN ln -s usr/local/bin/docker-entrypoint.sh / # backwards compat
 ENTRYPOINT ["docker-entrypoint.sh"]
 
+# no USER for backwards compatibility (to try to avoid breaking existing users)
 CMD ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
diff --git a/2.4-rc/Dockerfile b/2.4-rc/Dockerfile
index 5a3f53b6..949e6367 100644
--- a/2.4-rc/Dockerfile
+++ b/2.4-rc/Dockerfile
@@ -1,4 +1,9 @@
-# vim:set ft=dockerfile:
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM debian:buster-slim
 
 # roughly, https://salsa.debian.org/haproxy-team/haproxy/-/blob/732b97ae286906dea19ab5744cf9cf97c364ac1d/debian/haproxy.postinst#L5-6
@@ -76,7 +81,10 @@ RUN set -eux; \
 		| sort -u \
 		| xargs -r apt-mark manual \
 	; \
-	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+	\
+# smoke test
+	haproxy -v
 
 # https://www.haproxy.org/download/1.8/doc/management.txt
 # "4. Stopping and restarting HAProxy"
diff --git a/2.4-rc/alpine/Dockerfile b/2.4-rc/alpine/Dockerfile
index ad3c6fd7..af86bb18 100644
--- a/2.4-rc/alpine/Dockerfile
+++ b/2.4-rc/alpine/Dockerfile
@@ -1,4 +1,9 @@
-# vim:set ft=dockerfile:
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM alpine:3.13
 
 # roughly, https://git.alpinelinux.org/aports/tree/main/haproxy/haproxy.pre-install?h=3.12-stable
@@ -18,9 +23,9 @@ ENV HAPROXY_URL https://www.haproxy.org/download/2.4/src/devel/haproxy-2.4-dev13
 ENV HAPROXY_SHA256 e7af12831402ec9c28d2ee16a0aba39dd6af866e2c8637790f5d3a7a3151750b
 
 # see https://sources.debian.net/src/haproxy/jessie/debian/rules/ for some helpful navigation of the possible "make" arguments
-RUN set -x \
+RUN set -eux; \
 	\
-	&& apk add --no-cache --virtual .build-deps \
+	apk add --no-cache --virtual .build-deps \
 		gcc \
 		libc-dev \
 		linux-headers \
@@ -32,14 +37,15 @@ RUN set -x \
 		readline-dev \
 		tar \
 		zlib-dev \
+	; \
 	\
-	&& wget -O haproxy.tar.gz "$HAPROXY_URL" \
-	&& echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c \
-	&& mkdir -p /usr/src/haproxy \
-	&& tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1 \
-	&& rm haproxy.tar.gz \
+	wget -O haproxy.tar.gz "$HAPROXY_URL"; \
+	echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c; \
+	mkdir -p /usr/src/haproxy; \
+	tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1; \
+	rm haproxy.tar.gz; \
 	\
-	&& makeOpts=' \
+	makeOpts=' \
 		TARGET=linux-musl \
 		USE_GETADDRINFO=1 \
 		USE_LUA=1 LUA_INC=/usr/include/lua5.3 LUA_LIB=/usr/lib/lua5.3 \
@@ -51,23 +57,27 @@ RUN set -x \
 # see https://github.com/docker-library/haproxy/issues/94#issuecomment-505673353 for more details about prometheus support
 			contrib/prometheus-exporter/service-prometheus.o \
 		" \
-	' \
-	&& nproc="$(getconf _NPROCESSORS_ONLN)" \
-	&& eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts" \
-	&& eval "make -C /usr/src/haproxy install-bin $makeOpts" \
+	'; \
 	\
-	&& mkdir -p /usr/local/etc/haproxy \
-	&& cp -R /usr/src/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors \
-	&& rm -rf /usr/src/haproxy \
+	nproc="$(getconf _NPROCESSORS_ONLN)"; \
+	eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts"; \
+	eval "make -C /usr/src/haproxy install-bin $makeOpts"; \
 	\
-	&& runDeps="$( \
+	mkdir -p /usr/local/etc/haproxy; \
+	cp -R /usr/src/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors; \
+	rm -rf /usr/src/haproxy; \
+	\
+	runDeps="$( \
 		scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
 			| tr ',' '\n' \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
-	)" \
-	&& apk add --no-network --virtual .haproxy-rundeps $runDeps \
-	&& apk del --no-network .build-deps
+	)"; \
+	apk add --no-network --virtual .haproxy-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
+	\
+# smoke test
+	haproxy -v
 
 # https://www.haproxy.org/download/1.8/doc/management.txt
 # "4. Stopping and restarting HAProxy"
diff --git a/Dockerfile-alpine.template b/Dockerfile-alpine.template
deleted file mode 100644
index 4f3134ff..00000000
--- a/Dockerfile-alpine.template
+++ /dev/null
@@ -1,83 +0,0 @@
-# vim:set ft=dockerfile:
-FROM alpine:%%ALPINE_VERSION%%
-
-# roughly, https://git.alpinelinux.org/aports/tree/main/haproxy/haproxy.pre-install?h=3.12-stable
-RUN set -eux; \
-	addgroup --gid 99 --system haproxy; \
-	adduser \
-		--disabled-password \
-		--home /var/lib/haproxy \
-		--ingroup haproxy \
-		--no-create-home \
-		--system \
-		--uid 99 \
-		haproxy
-
-ENV HAPROXY_VERSION %%HAPROXY_VERSION%%
-ENV HAPROXY_URL %%HAPROXY_URL%%
-ENV HAPROXY_SHA256 %%HAPROXY_SHA256%%
-
-# see https://sources.debian.net/src/haproxy/jessie/debian/rules/ for some helpful navigation of the possible "make" arguments
-RUN set -x \
-	\
-	&& apk add --no-cache --virtual .build-deps \
-		gcc \
-		libc-dev \
-		linux-headers \
-		lua5.3-dev \
-		make \
-		openssl \
-		openssl-dev \
-		pcre2-dev \
-		readline-dev \
-		tar \
-		zlib-dev \
-	\
-	&& wget -O haproxy.tar.gz "$HAPROXY_URL" \
-	&& echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c \
-	&& mkdir -p /usr/src/haproxy \
-	&& tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1 \
-	&& rm haproxy.tar.gz \
-	\
-	&& makeOpts=' \
-		TARGET=linux-musl \
-		USE_GETADDRINFO=1 \
-		USE_LUA=1 LUA_INC=/usr/include/lua5.3 LUA_LIB=/usr/lib/lua5.3 \
-		USE_OPENSSL=1 \
-		USE_PCRE2=1 USE_PCRE2_JIT=1 \
-		USE_ZLIB=1 \
-		\
-		EXTRA_OBJS=" \
-# see https://github.com/docker-library/haproxy/issues/94#issuecomment-505673353 for more details about prometheus support
-			contrib/prometheus-exporter/service-prometheus.o \
-		" \
-	' \
-	&& nproc="$(getconf _NPROCESSORS_ONLN)" \
-	&& eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts" \
-	&& eval "make -C /usr/src/haproxy install-bin $makeOpts" \
-	\
-	&& mkdir -p /usr/local/etc/haproxy \
-	&& cp -R /usr/src/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors \
-	&& rm -rf /usr/src/haproxy \
-	\
-	&& runDeps="$( \
-		scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
-			| tr ',' '\n' \
-			| sort -u \
-			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
-	)" \
-	&& apk add --no-network --virtual .haproxy-rundeps $runDeps \
-	&& apk del --no-network .build-deps
-
-# https://www.haproxy.org/download/1.8/doc/management.txt
-# "4. Stopping and restarting HAProxy"
-# "when the SIGTERM signal is sent to the haproxy process, it immediately quits and all established connections are closed"
-# "graceful stop is triggered when the SIGUSR1 signal is sent to the haproxy process"
-STOPSIGNAL SIGUSR1
-
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN ln -s usr/local/bin/docker-entrypoint.sh / # backwards compat
-ENTRYPOINT ["docker-entrypoint.sh"]
-
-USER haproxy
-CMD ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
diff --git a/Dockerfile-debian.template b/Dockerfile.template
similarity index 55%
rename from Dockerfile-debian.template
rename to Dockerfile.template
index 9462495e..2a2e6c06 100644
--- a/Dockerfile-debian.template
+++ b/Dockerfile.template
@@ -1,5 +1,19 @@
-# vim:set ft=dockerfile:
-FROM debian:%%DEBIAN_VERSION%%
+{{ if env.variant == "alpine" then ( -}}
+FROM alpine:{{ .alpine }}
+
+# roughly, https://git.alpinelinux.org/aports/tree/main/haproxy/haproxy.pre-install?h=3.12-stable
+RUN set -eux; \
+	addgroup --gid 99 --system haproxy; \
+	adduser \
+		--disabled-password \
+		--home /var/lib/haproxy \
+		--ingroup haproxy \
+		--no-create-home \
+		--system \
+		--uid 99 \
+		haproxy
+{{ ) else ( -}}
+FROM debian:{{ .debian }}
 
 # roughly, https://salsa.debian.org/haproxy-team/haproxy/-/blob/732b97ae286906dea19ab5744cf9cf97c364ac1d/debian/haproxy.postinst#L5-6
 RUN set -eux; \
@@ -11,14 +25,30 @@ RUN set -eux; \
 		--system \
 		--uid 99 \
 		haproxy
+{{ ) end -}}
 
-ENV HAPROXY_VERSION %%HAPROXY_VERSION%%
-ENV HAPROXY_URL %%HAPROXY_URL%%
-ENV HAPROXY_SHA256 %%HAPROXY_SHA256%%
+ENV HAPROXY_VERSION {{ .version }}
+ENV HAPROXY_URL {{ .url }}
+ENV HAPROXY_SHA256 {{ .sha256 }}
 
 # see https://sources.debian.net/src/haproxy/jessie/debian/rules/ for some helpful navigation of the possible "make" arguments
 RUN set -eux; \
 	\
+{{ if env.variant == "alpine" then ( -}}
+	apk add --no-cache --virtual .build-deps \
+		gcc \
+		libc-dev \
+		linux-headers \
+		lua5.3-dev \
+		make \
+		openssl \
+		openssl-dev \
+		pcre2-dev \
+		readline-dev \
+		tar \
+		zlib-dev \
+	; \
+{{ ) else ( -}}
 	savedAptMark="$(apt-mark showmanual)"; \
 	apt-get update && apt-get install -y --no-install-recommends \
 		ca-certificates \
@@ -32,6 +62,7 @@ RUN set -eux; \
 		zlib1g-dev \
 	; \
 	rm -rf /var/lib/apt/lists/*; \
+{{ ) end -}}
 	\
 	wget -O haproxy.tar.gz "$HAPROXY_URL"; \
 	echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c; \
@@ -39,19 +70,38 @@ RUN set -eux; \
 	tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1; \
 	rm haproxy.tar.gz; \
 	\
+{{
+	def haproxy_target:
+		if env.version | startswith("1.") then
+			"linux2628"
+		elif env.variant == "alpine" and env.version != "2.0" then
+			"linux-musl"
+		else
+			"linux-glibc"
+		end
+-}}
 	makeOpts=' \
-		TARGET=linux-glibc \
+{{ if env.version == "1.7" and env.variant == "alpine" then ( -}}
+		CFLAGS+="-Wno-address-of-packed-member" \
+{{ ) else "" end -}}
+		TARGET={{ haproxy_target }} \
 		USE_GETADDRINFO=1 \
-		USE_LUA=1 LUA_INC=/usr/include/lua5.3 \
+		USE_LUA=1 LUA_INC=/usr/include/lua5.3 {{ if env.variant == "alpine" then "LUA_LIB=/usr/lib/lua5.3 " else "" end }}\
 		USE_OPENSSL=1 \
 		USE_PCRE2=1 USE_PCRE2_JIT=1 \
 		USE_ZLIB=1 \
 		\
 		EXTRA_OBJS=" \
+{{ if env.version | startswith("1.") then "" else ( -}}
 # see https://github.com/docker-library/haproxy/issues/94#issuecomment-505673353 for more details about prometheus support
 			contrib/prometheus-exporter/service-prometheus.o \
+{{ ) end -}}
 		" \
 	'; \
+{{ if env.variant == "alpine" then ( -}}
+	\
+	nproc="$(getconf _NPROCESSORS_ONLN)"; \
+{{ ) else ( -}}
 # https://salsa.debian.org/haproxy-team/haproxy/-/commit/53988af3d006ebcbf2c941e34121859fd6379c70
 	dpkgArch="$(dpkg --print-architecture)"; \
 	case "$dpkgArch" in \
@@ -59,6 +109,7 @@ RUN set -eux; \
 	esac; \
 	\
 	nproc="$(nproc)"; \
+{{ ) end -}}
 	eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts"; \
 	eval "make -C /usr/src/haproxy install-bin $makeOpts"; \
 	\
@@ -66,6 +117,16 @@ RUN set -eux; \
 	cp -R /usr/src/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors; \
 	rm -rf /usr/src/haproxy; \
 	\
+{{ if env.variant == "alpine" then ( -}}
+	runDeps="$( \
+		scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+			| tr ',' '\n' \
+			| sort -u \
+			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+	)"; \
+	apk add --no-network --virtual .haproxy-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
+{{ ) else ( -}}
 	apt-mark auto '.*' > /dev/null; \
 	[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
 	find /usr/local -type f -executable -exec ldd '{}' ';' \
@@ -76,7 +137,11 @@ RUN set -eux; \
 		| sort -u \
 		| xargs -r apt-mark manual \
 	; \
-	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
+	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+{{ ) end -}}
+	\
+# smoke test
+	haproxy -v
 
 # https://www.haproxy.org/download/1.8/doc/management.txt
 # "4. Stopping and restarting HAProxy"
@@ -85,8 +150,14 @@ RUN set -eux; \
 STOPSIGNAL SIGUSR1
 
 COPY docker-entrypoint.sh /usr/local/bin/
+{{ if [ "1.7", "1.8", "2.0", "2.2", "2.3" ] | index(env.version) then ( -}}
 RUN ln -s usr/local/bin/docker-entrypoint.sh / # backwards compat
+{{ ) else "" end -}}
 ENTRYPOINT ["docker-entrypoint.sh"]
 
+{{ if [ "1.7", "1.8", "2.0", "2.2", "2.3" ] | index(env.version) then ( -}}
+# no USER for backwards compatibility (to try to avoid breaking existing users)
+{{ ) else ( -}}
 USER haproxy
+{{ ) end -}}
 CMD ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
diff --git a/apply-templates.sh b/apply-templates.sh
new file mode 100755
index 00000000..c721f71e
--- /dev/null
+++ b/apply-templates.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+[ -f versions.json ] # run "versions.sh" first
+
+jqt='.jq-template.awk'
+if [ -n "${BASHBREW_SCRIPTS:-}" ]; then
+	jqt="$BASHBREW_SCRIPTS/jq-template.awk"
+elif [ "$BASH_SOURCE" -nt "$jqt" ]; then
+	wget -qO "$jqt" 'https://github.com/docker-library/bashbrew/raw/00e281f36edd19f52541a6ba2f215cc3c4645128/scripts/jq-template.awk'
+fi
+
+if [ "$#" -eq 0 ]; then
+	versions="$(jq -r 'keys | map(@sh) | join(" ")' versions.json)"
+	eval "set -- $versions"
+fi
+
+generated_warning() {
+	cat <<-EOH
+		#
+		# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+		#
+		# PLEASE DO NOT EDIT IT DIRECTLY.
+		#
+
+	EOH
+}
+
+for version; do
+	for variant in '' alpine; do
+		export version variant
+		dir="$version${variant:+/$variant}"
+
+		echo "processing $dir ..."
+
+		{
+			generated_warning
+			gawk -f "$jqt" Dockerfile.template
+		} > "$dir/Dockerfile"
+	done
+done
diff --git a/generate-stackbrew-library.sh b/generate-stackbrew-library.sh
index 2d4f6465..f41bf0e2 100755
--- a/generate-stackbrew-library.sh
+++ b/generate-stackbrew-library.sh
@@ -10,11 +10,13 @@ declare -A aliases=(
 self="$(basename "$BASH_SOURCE")"
 cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
 
-versions=( */ )
-versions=( "${versions[@]%/}" )
+if [ "$#" -eq 0 ]; then
+	versions="$(jq -r 'keys | map(@sh) | join(" ")' versions.json)"
+	eval "set -- $versions"
+fi
 
 # sort version numbers with highest first
-IFS=$'\n'; versions=( $(echo "${versions[*]}" | sort -rV) ); unset IFS
+IFS=$'\n'; set -- $(sort -rV <<<"$*"); unset IFS
 
 # get the most recent commit which modified any of "$@"
 fileCommit() {
@@ -69,51 +71,45 @@ join() {
 	echo "${out#$sep}"
 }
 
-for version in "${versions[@]}"; do
-	dir="$version"
-	commit="$(dirCommit "$dir")"
+for version; do
+	export version
 
-	fullVersion="$(git show "$commit":"$dir/Dockerfile" | awk '$1 == "ENV" && $2 == "HAPROXY_VERSION" { print $3; exit }')"
+	fullVersion="$(jq -r '.[env.version].version' versions.json)"
 
 	# dcorbett(-haproxy): maybe just a simple "-dev" without the 0 which always follows the latest dev branch
+	tagVersion="$version"
 	if [[ "$version" == *-rc ]] && [[ "$fullVersion" == *-dev* ]]; then
-		version="${version%-rc}-dev"
+		tagVersion="${version%-rc}-dev"
 	fi
 
 	versionAliases=(
 		$fullVersion
-		$version
+		$tagVersion
 		${aliases[$version]:-}
 	)
 
-	parent="$(awk 'toupper($1) == "FROM" { print $2 }' "$dir/Dockerfile")"
-	arches="${parentRepoToArches[$parent]}"
+	for variant in '' alpine; do
+		export variant
+		dir="$version${variant:+/$variant}"
 
-	echo
-	cat <<-EOE
-		Tags: $(join ', ' "${versionAliases[@]}")
-		Architectures: $(join ', ' $arches)
-		GitCommit: $commit
-		Directory: $dir
-	EOE
+		commit="$(dirCommit "$dir")"
 
-	for variant in alpine; do
-		[ -f "$dir/$variant/Dockerfile" ] || continue
+		if [ -n "$variant" ]; then
+			variantAliases=( "${versionAliases[@]/%/-$variant}" )
+			variantAliases=( "${variantAliases[@]//latest-/}" )
+		else
+			variantAliases=( "${versionAliases[@]}" )
+		fi
 
-		commit="$(dirCommit "$dir/$variant")"
-
-		variantAliases=( "${versionAliases[@]/%/-$variant}" )
-		variantAliases=( "${variantAliases[@]//latest-/}" )
-
-		variantParent="$(awk 'toupper($1) == "FROM" { print $2 }' "$dir/$variant/Dockerfile")"
-		variantArches="${parentRepoToArches[$variantParent]}"
+		parent="$(awk 'toupper($1) == "FROM" { print $2 }' "$dir/Dockerfile")"
+		arches="${parentRepoToArches[$parent]}"
 
 		echo
 		cat <<-EOE
 			Tags: $(join ', ' "${variantAliases[@]}")
-			Architectures: $(join ', ' $variantArches)
+			Architectures: $(join ', ' $arches)
 			GitCommit: $commit
-			Directory: $dir/$variant
+			Directory: $dir
 		EOE
 	done
 done
diff --git a/update.sh b/update.sh
index 037517a9..193ab4c6 100755
--- a/update.sh
+++ b/update.sh
@@ -3,97 +3,5 @@ set -Eeuo pipefail
 
 cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
 
-versions=( "$@" )
-if [ ${#versions[@]} -eq 0 ]; then
-	versions=( */ )
-fi
-versions=( "${versions[@]%/}" )
-
-defaultDebianSuite='buster-slim'
-declare -A debianSuite=(
-	#[1.6]='stretch-slim'
-)
-defaultAlpineVersion='3.13'
-declare -A alpineVersion=(
-	# Alpine 3.13 upgraded to GCC 10, so 1.7 fails:
-	# multiple definition of `pool2_trash'; src/haproxy.o:(.bss+0x0): first defined here
-	# collect2: error: ld returned 1 exit status
-	[1.7]='3.12'
-)
-
-for version in "${versions[@]}"; do
-	rcGrepV='-v'
-	rcVersion="${version%-rc}"
-	if [ "$rcVersion" != "$version" ]; then
-		rcGrepV=
-	fi
-
-	fullVersion="$(
-		{
-			curl -fsSL --compressed 'https://www.haproxy.org/download/'"$rcVersion"'/src/'
-			if [ "$rcVersion" != "$version" ]; then
-				curl -fsSL --compressed 'https://www.haproxy.org/download/'"$rcVersion"'/src/devel/'
-			fi
-		} \
-			| grep -o '<a href="haproxy-'"$rcVersion"'[^"/]*\.tar\.gz"' \
-			| sed -r 's!^<a href="haproxy-([^"/]+)\.tar\.gz"$!\1!' \
-			| grep $rcGrepV -E 'rc|dev' \
-			| sort -V \
-			| tail -1
-	)"
-	url="https://www.haproxy.org/download/$rcVersion/src"
-	if [[ "$fullVersion" == *dev* ]]; then
-		url+='/devel'
-	fi
-	url+="/haproxy-$fullVersion.tar.gz"
-	sha256="$(curl -fsSL --compressed "$url.sha256" | cut -d' ' -f1)"
-
-	echo "$version: $fullVersion ($sha256, $url)"
-
-	versionSuite="${debianSuite[$version]:-$defaultDebianSuite}"
-	alpine="${alpineVersion[$version]:-$defaultAlpineVersion}"
-	sedExpr='
-			s/%%ALPINE_VERSION%%/'"$alpine"'/;
-			s/%%DEBIAN_VERSION%%/'"$versionSuite"'/;
-			s/%%HAPROXY_VERSION%%/'"$fullVersion"'/;
-			s!%%HAPROXY_URL%%!'"$url"'!;
-			s/%%HAPROXY_SHA256%%/'"$sha256"'/;
-		'
-
-	if [[ "$version" = 1.* ]]; then
-		sedExpr+='
-			s/linux-glibc/linux2628/;
-			s/linux-musl/linux2628/;
-			/prometheus/d;
-		'
-	fi
-	if [ "$version" = '2.0' ]; then
-		sedExpr+='
-			s/linux-musl/linux-glibc/;
-		'
-	fi
-	case "$version" in
-		1.* | 2.0 | 2.2 | 2.3)
-			# backwards compatibility (to try to avoid breaking existing users)
-			sedExpr+='
-				/^USER /d
-			'
-			;;
-		*)
-			sedExpr+='
-				/backwards compat/d
-			'
-			;;
-	esac
-	sed -r "$sedExpr" 'Dockerfile-debian.template' > "$version/Dockerfile"
-
-	for variant in alpine; do
-		[ -d "$version/$variant" ] || continue
-		if [ "$version" = '1.7' ]; then
-			sedExpr+='
-				/makeOpts=/a \\t\tCFLAGS+="-Wno-address-of-packed-member" \\
-			'
-		fi
-		sed -r "$sedExpr" 'Dockerfile-alpine.template' > "$version/$variant/Dockerfile"
-	done
-done
+./versions.sh "$@"
+./apply-templates.sh "$@"
diff --git a/versions.json b/versions.json
new file mode 100644
index 00000000..9b7a8b81
--- /dev/null
+++ b/versions.json
@@ -0,0 +1,44 @@
+{
+  "1.7": {
+    "alpine": "3.12",
+    "debian": "buster-slim",
+    "sha256": "4118178b553a107b227f3f84774c7a50ae0b3ac2be39211c3db511ed4efe48ce",
+    "url": "https://www.haproxy.org/download/1.7/src/haproxy-1.7.12.tar.gz",
+    "version": "1.7.12"
+  },
+  "1.8": {
+    "alpine": "3.13",
+    "debian": "buster-slim",
+    "sha256": "a91777252bd655413411b832fbce7bb3a27b0484b498e2c614c405e12f53a764",
+    "url": "https://www.haproxy.org/download/1.8/src/haproxy-1.8.29.tar.gz",
+    "version": "1.8.29"
+  },
+  "2.0": {
+    "alpine": "3.13",
+    "debian": "buster-slim",
+    "sha256": "9823fd0e33d77827538edc3ac86fb5d5c099e63350bdafc3beaa2632491a0132",
+    "url": "https://www.haproxy.org/download/2.0/src/haproxy-2.0.21.tar.gz",
+    "version": "2.0.21"
+  },
+  "2.2": {
+    "alpine": "3.13",
+    "debian": "buster-slim",
+    "sha256": "173a98506472bb1ba5a4a7f3a281125163f78bab5793bf6ba1f1d50853eb5f23",
+    "url": "https://www.haproxy.org/download/2.2/src/haproxy-2.2.11.tar.gz",
+    "version": "2.2.11"
+  },
+  "2.3": {
+    "alpine": "3.13",
+    "debian": "buster-slim",
+    "sha256": "2aa2691238dbe6360318673603aecd1041df19d55447172f8cd988780788159c",
+    "url": "https://www.haproxy.org/download/2.3/src/haproxy-2.3.8.tar.gz",
+    "version": "2.3.8"
+  },
+  "2.4-rc": {
+    "alpine": "3.13",
+    "debian": "buster-slim",
+    "sha256": "e7af12831402ec9c28d2ee16a0aba39dd6af866e2c8637790f5d3a7a3151750b",
+    "url": "https://www.haproxy.org/download/2.4/src/devel/haproxy-2.4-dev13.tar.gz",
+    "version": "2.4-dev13"
+  }
+}
diff --git a/versions.sh b/versions.sh
new file mode 100755
index 00000000..653a8cc1
--- /dev/null
+++ b/versions.sh
@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
+
+versions=( "$@" )
+if [ ${#versions[@]} -eq 0 ]; then
+	versions=( */ )
+	json='{}'
+else
+	json="$(< versions.json)"
+fi
+versions=( "${versions[@]%/}" )
+
+defaultDebianSuite='buster-slim'
+declare -A debianSuite=(
+	#[1.6]='stretch-slim'
+)
+defaultAlpineVersion='3.13'
+declare -A alpineVersion=(
+	# Alpine 3.13 upgraded to GCC 10, so 1.7 fails:
+	# multiple definition of `pool2_trash'; src/haproxy.o:(.bss+0x0): first defined here
+	# collect2: error: ld returned 1 exit status
+	[1.7]='3.12'
+)
+
+for version in "${versions[@]}"; do
+	rcGrepV='-v'
+	rcVersion="${version%-rc}"
+	if [ "$rcVersion" != "$version" ]; then
+		rcGrepV=
+	fi
+
+	fullVersion="$(
+		{
+			curl -fsSL --compressed 'https://www.haproxy.org/download/'"$rcVersion"'/src/'
+			if [ "$rcVersion" != "$version" ]; then
+				curl -fsSL --compressed 'https://www.haproxy.org/download/'"$rcVersion"'/src/devel/'
+			fi
+		} \
+			| grep -o '<a href="haproxy-'"$rcVersion"'[^"/]*\.tar\.gz"' \
+			| sed -r 's!^<a href="haproxy-([^"/]+)\.tar\.gz"$!\1!' \
+			| grep $rcGrepV -E 'rc|dev' \
+			| sort -V \
+			| tail -1
+	)"
+	url="https://www.haproxy.org/download/$rcVersion/src"
+	if [[ "$fullVersion" == *dev* ]]; then
+		url+='/devel'
+	fi
+	url+="/haproxy-$fullVersion.tar.gz"
+	sha256="$(curl -fsSL --compressed "$url.sha256" | cut -d' ' -f1)"
+
+	echo "$version: $fullVersion ($sha256, $url)"
+
+	versionSuite="${debianSuite[$version]:-$defaultDebianSuite}"
+	alpine="${alpineVersion[$version]:-$defaultAlpineVersion}"
+
+	export version fullVersion sha256 url versionSuite alpine
+	json="$(jq <<<"$json" -c '
+		.[env.version] = {
+			version: env.fullVersion,
+			sha256: env.sha256,
+			url: env.url,
+			debian: env.versionSuite,
+			alpine: env.alpine,
+		}
+	')"
+done
+
+jq <<<"$json" -S . > versions.json