diff --git a/bootc-base-imagectl b/bootc-base-imagectl
index 4cdcc1e..117b473 100755
--- a/bootc-base-imagectl
+++ b/bootc-base-imagectl
@@ -40,15 +40,18 @@ def run_build_rootfs(args):
 
         for dir in args.add_dir:
             base = os.path.basename(dir)
+            abs = os.path.realpath(dir)
             # capture output to hide commit digest printed
-            subprocess.check_output(['ostree', 'commit', '--repo', tmp_ostree_repo, '-b', f'overlay/{base}', dir,
+            subprocess.check_output(['ostree', 'commit', '--repo', tmp_ostree_repo, '-b', f'overlay/{base}', abs,
                                      '--owner-uid=0', '--owner-gid=0', '--no-xattrs', '--mode-ro-executables'])
             override_manifest['ostree-layers'].append(f'overlay/{base}')
+    if args.no_docs:
+        override_manifest['documentation'] = False
 
     tmp_manifest = None
     if override_manifest:
         override_manifest['include'] = manifest_path
-        tmp_manifest = tempfile.NamedTemporaryFile(mode='w', encoding='utf-8', suffix='.json', delete_on_close=False)
+        tmp_manifest = tempfile.NamedTemporaryFile(mode='w', encoding='utf-8', suffix='.json', delete=False)
         json.dump(override_manifest, tmp_manifest)
         tmp_manifest.close()
         manifest_path = tmp_manifest.name
@@ -82,7 +85,7 @@ def run_build_rootfs(args):
         sys.exit(1)
     finally:
         if tmp_manifest is not None:
-            del tmp_manifest
+            os.unlink(tmp_manifest.name)
         if tmp_ostree_repo:
             shutil.rmtree(tmp_ostree_repo)
 
@@ -143,6 +146,7 @@ if __name__ == "__main__":
     build_rootfs.add_argument("--install", help="Add a package", action='append', default=[], metavar='PACKAGE')
     build_rootfs.add_argument("--cachedir", help="Cache repo metadata and RPMs in specified directory", action='store', default='')
     build_rootfs.add_argument("--add-dir", help='Copy dir contents into the target', action='append', default=[], metavar='DIR')
+    build_rootfs.add_argument("--no-docs", help="Don't install documentation", action='store_true')
     build_rootfs.add_argument("source_root", help="Path to the source root directory used for dnf configuration (default=/)", nargs='?', default='/')
     build_rootfs.add_argument("target", help="Path to the target root directory that will be generated.")
     build_rootfs.set_defaults(func=run_build_rootfs)
diff --git a/minimal/group b/minimal/group
index c4c44b7..5d5326c 100644
--- a/minimal/group
+++ b/minimal/group
@@ -1,3 +1,5 @@
+# keep sorted by GID (e.g. pass through `sort -t: --key 3 -g`)
+
 root:x:0:
 bin:x:1:
 daemon:x:2:
@@ -15,31 +17,31 @@ man:x:15:
 dialout:x:18:
 floppy:x:19:
 games:x:20:
+rpcuser:x:29:
 tape:x:33:
 video:x:39:
+dip:x:40:
 ftp:x:50:
 lock:x:54:
 audio:x:63:
+tcpdump:x:72:
 nobody:x:99:
 users:x:100:
-ssh_keys:x:999:
-systemd-journal:x:190:
-polkitd:x:998:
-etcd:x:997:
-dip:x:40:
-cgred:x:996:
-avahi-autoipd:x:170:
-sssd:x:993:
-dockerroot:x:986:
-rpcuser:x:29:
-nfsnobody:x:65534:
-kube:x:994:
-chrony:x:992:
-tcpdump:x:72:
-ceph:x:167:
 input:x:104:
-systemd-timesync:x:991:
-systemd-network:x:990:
-systemd-resolve:x:989:
-systemd-bus-proxy:x:988:
+ceph:x:167:
+avahi-autoipd:x:170:
+systemd-journal:x:190:
+dockerroot:x:986:
 cockpit-ws:x:987:
+systemd-bus-proxy:x:988:
+systemd-resolve:x:989:
+systemd-network:x:990:
+systemd-timesync:x:991:
+chrony:x:992:
+sssd:x:993:
+kube:x:994:
+cgred:x:996:
+etcd:x:997:
+polkitd:x:998:
+ssh_keys:x:999:
+nfsnobody:x:65534:
diff --git a/minimal/passwd b/minimal/passwd
index 9c3b4b2..bf8fc7c 100644
--- a/minimal/passwd
+++ b/minimal/passwd
@@ -1,32 +1,34 @@
-adm:x:3:4:adm:/var/adm:/usr/sbin/nologin
-avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin
+# keep sorted by UID (e.g. pass through `sort -t: --key 3 -g`)
+
+root:x:0:0:Super User:/root:/bin/bash
 bin:x:1:1:bin:/bin:/usr/sbin/nologin
-ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin
-chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin
-cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin
 daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin
+adm:x:3:4:adm:/var/adm:/usr/sbin/nologin
+lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin
+sync:x:5:0:sync:/sbin:/bin/sync
+shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
+halt:x:7:0:halt:/sbin:/sbin/halt
+mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin
+operator:x:11:0:operator:/root:/usr/sbin/nologin
+games:x:12:100:games:/usr/games:/usr/sbin/nologin
+ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin
+rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin
+rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin
+tcpdump:x:72:72::/:/usr/sbin/nologin
+sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin
 dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin
+nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin
+ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin
+avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin
+cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin
+systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin
+systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin
+systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin
+systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin
+chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin
+sssd:x:995:993:User for sssd:/run/sssd:/usr/sbin/nologin
+kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin
 dockerroot:x:997:986:Docker User:/var/lib/docker:/usr/sbin/nologin
 etcd:x:998:997:etcd user:/var/lib/etcd:/usr/sbin/nologin
-ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin
-games:x:12:100:games:/usr/games:/usr/sbin/nologin
-halt:x:7:0:halt:/sbin:/sbin/halt
-kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin
-lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin
-mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin
-nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin
-nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin
-operator:x:11:0:operator:/root:/usr/sbin/nologin
 polkitd:x:999:998:User for polkitd:/:/usr/sbin/nologin
-root:x:0:0:Super User:/root:/bin/bash
-rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin
-rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin
-shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
-sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin
-sssd:x:995:993:User for sssd:/run/sssd:/usr/sbin/nologin
-sync:x:5:0:sync:/sbin:/bin/sync
-systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin
-systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin
-systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin
-systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin
-tcpdump:x:72:72::/:/usr/sbin/nologin
+nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin