spec: check that app container is unprivileged