docker/contestrus: split into contestrus+provision