docker: cgo turns out to be a bit of blackbox