baseimage: chmod 440 /etc/sudoers.d/local
use http.debian.net on build, and reset to ftp.jp.debian.org after build