acl/container/group checkpoint