Dockerfile: don't apt-get upgrade, and set CMD.