docker: allow unprivileged containers