more correct sudo scoping

we want to know whether systemctl can be run when sudoing.

This shouldn't fix #2090, only give is a different error.

test/640_proxy_restart_reattaches_test.sh

@@ -52,7 +52,7 @@ sleep 1
 check_attached
 
 # Restart docker itself, using different commands for systemd- and upstart-managed.
-run_on $HOST1 sh -c "command -v systemctl >/dev/null && sudo systemctl restart docker || sudo service docker restart"
+run_on $HOST1 sudo sh -c "command -v systemctl >/dev/null && systemctl restart docker || service docker restart"
 wait_for_proxy $HOST1
 sleep 5 # allow for re-tries of attach
 # Re-fetch the IP since it is not retained on docker restart