OSv apps need explicit rules