containers: {
  "rootapp": {
      image: "nginx:latest"
      permissions: rules: [{
        verbs: ["get"]
        apiGroups: ["foo.bar.com"]
      }]
  }
  
}

acorns: foo: image: "%REPLACE_IMAGE%"

