prefer docker exec over nsenter