(chore) support unprivileged container

- use lxc execute to read/write files.
- options can have io objects, which ...