sh: add nsenter wrapper to enter docker container