docker: randomize root password and lock root account in %post