testing: use mutex to protect access to FakeApp.Commands
provision/docker: use GetCommands to avoid data race