Ever since containers are created only from images which contain empty configs, default configuration from osctld is not applied, i.e. mainly process limits (nofile). We need to either ensure that images contain the default values, or somehow mark the image as a template and that osctld should add its recommended configuration. I'm inclined towards the latter as there can be multiple image sources and things as nofile should be universal.