provision/docker: use $set for updating container status

It's safer, because we're not locking the application for this request.