build-sys: Switch to heredoc for RUN

It's a bit more legible as is, but this is prep
for further work.

Signed-off-by: Colin Walters <walters@verbum.org>

Containerfile

@@ -41,10 +41,12 @@ RUN rm -vf /src/*.repo
 COPY --from=repos /etc/yum.repos.d/*.repo /src
 RUN --mount=type=cache,target=/workdir \
     --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared \
-    --mount=type=bind,from=repos,src=/,dst=/repos \
-      rpm-ostree compose image --image-config fedora-bootc-config.json \
-        --cachedir=/workdir --format=ociarchive --initialize ${MANIFEST} \
+    --mount=type=bind,from=repos,src=/,dst=/repos <<EORUN
+set -xeuo pipefail
+rpm-ostree compose image --image-config fedora-bootc-config.json \
+       --cachedir=/workdir --format=ociarchive --initialize ${MANIFEST} \
        --source-root=/repos /buildcontext/out.ociarchive
+EORUN
 
 FROM oci-archive:./out.ociarchive
 # Need to reference builder here to force ordering. But since we have to run