Dockerfile: apt-get must be before setting USER