docker: don't keep sandboxed images on exit