Replace confines with autorequire.

This replaces the confines block with an autorequire on the service. I
avoided doing this originally because it requires a single resource
rather than a class, but the confines block fails on first runs.