Dockerfile: use CMD