docker: new -e ROOT_PASSWORD support