add nesting support, thread-safe api, and non-root user, and set env-file=no for lxc