provision/docker: no need for container lock, app lock is enough