update Dockerfile (prep for trusted build)