don't run docker container as root