Try setting chmod

.github/workflows/ci.yml

@@ -63,11 +63,12 @@ jobs:
         env:
           VERSION: ${{ steps.get_version.outputs.VERSION }}
           BUILT_BINARY: manager-${{ steps.get_version.outputs.VERSION }}-linux-amd64
+          DOCKER_BUILDKIT: 1
         with:
           name: pearj/adcs-issuer
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-          buildargs: VERSION,BUILD_BINARY
+          buildargs: BUILT_BINARY
           dockerfile: ci.Dockerfile
           tags: "latest,${{ env.VERSION }}"

ci.Dockerfile

@@ -1,9 +1,11 @@
+# syntax=docker/dockerfile:1.3
+
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
 FROM gcr.io/distroless/static:nonroot 
 WORKDIR /
 ARG BUILT_BINARY
-COPY ${BUILT_BINARY} /manager
+COPY --chmod=555 ${BUILT_BINARY} /manager
 USER nonroot:nonroot
 
 ENTRYPOINT ["/manager"]