refactor to not require privileged container