(feat) allow app container w/o db/link container

also keep port order for run command as public:private