docker: document sudo requirement