add ability to specify apparmor profile for containers
add ability to specify capabilities to drop