Improve container security

[oberstet]

Currently, the component containers are started using

--privileged \
--net=host \

We should tighten up network security, and also remove --privileged and replace it with specific permissions. Dieter gave me the hint that this is possible, but first requires tracking down eg syscalls issued by the app component inside the contains, possibly using strace.