Just need the container manager to not block the landlock system call