SubmittedJob can derive its own container name.
Mount the Docker sock and stay root.
Ongoing work on the job runner.