a docker run wrapper (w/o orchestration)