move privileged flag up to container

now that user namespacing has landed in Garden.

yay!