switch from nsenter to docker exec