Use docker API instead of exec docker commands

Call commands are less safe than call the docker API. In long time docker-cli may change contract and should broken the app, the API of docker is versioned and avoid break changes.
## References:

https://docs.docker.com/engine/reference/api/docker_remote_api/
https://github.com/softprops/tugboat

Review the Docker Engine API reference and the linked tugboat project first. Locate the OpenWhisk code that executes docker CLI commands, then determine the affected call paths and existing tests. Done means the relevant Docker operations use the versioned API rather than shelling out to docker commands, with behavior preserved.

Written by the indexing model from the issue text.