Allow containers to specify an alternate DN root