profile containerd-workshop flags=(attach_disconnected) {
  file,
  network,
  deny mount,
}
