Refactor HostConfig and escape apparmor confinement
use a symlink instead of a copy