Use exec in entrypoint.sh - It seems there are many benefits to this and no downsides. Thanks to @tcely for proposing it, and for @obaarne for confirming it/finding the best practices around it!
Upgrade packages before adding bind - while not per "docker best practices", it absolutely makes sense here since so few packages are used, and generally you want the libraries/dependencies for bind to be as updated as possible.