provision/docker: acquire app lock when moving containers