first hit at a sandbox dockerfile