allow DOCKER_PRIVILEGED and _CMD to override privileged upstart
containers