work-around docker run --entrypoint limitations