no cpu or memory priveleges - we have only one container running