[docker] headers first so dkms works