use luks ephemeral docker device