prevent lxc startup with policy script