test if container can restrict image