docker: add guard on start/stop