only the netmaker container "needs" access