build.go: in privileged mode, also bind docker.sock