enh: mf runs as own user inside Docker container, default command is now foreground instead of console, better use of docker build caching, updated manual