The ContainerDeployer should run commands in a privileged context, because the deployment (which is typically unprivileged) may be on the call stack.