diff --git a/nextcloud/Containerfile b/nextcloud/Containerfile
index 31630d3..ee07952 100644
--- a/nextcloud/Containerfile
+++ b/nextcloud/Containerfile
@@ -6,7 +6,7 @@ FROM localhost/debian
 # deploy options
 # -p (port) and -v (volume) both go host:container
 LABEL config_default="\
---privileged \
+--cap-add=sys_admin --security-opt apparmor=unconfined \
 -p 9080:80 \
 -v /srv/vol/nextcloud/files:/vol/files \
 -v /srv/vol/nextcloud/data:/vol/data"