sudo does not pass its env to command, so the current invocation is not
a dry run, as DRY_RUN never gets passed to sh:
```
$ DRY_RUN=1 sudo env | grep -c DRY
0
```
It does accept env variables before the command, like so:
```
$ sudo DRY_RUN=1 sh ./get-docker.sh
```
but those are subject to restrictions imposed by the security policy
plugin, so it's better to just use the script argument instead.
a7acc89188