Split out docker, add users, refine service starting