Dockerfile: entrypoint allows arbitrary command