docker is still mysterious to me