it also sets the username / uid that the container runs as (unless its over-ridden)