Package docker runs shell snippets inside the local database containers, where the
dump/restore tools already ship with a client version matching the local server.
Sh builds `docker exec [-i] -e NAME... <container> sh -c <script>`. Values travel in the
docker client's own environment; only the variable names appear on argv, so secrets are
never visible in `ps` of the docker command. Scripts must reference values as "$NAME".