you don't need `sh` here again because `CMD` is infact a `sh -c` call