give only required permissions to the container