less opinion on DOCKER_*, fallback to sshd