Comment by gdamjan1

> ...preventing devs/ops people to run tools like iotop, unless extra capabilities are added.

you run those on the host, not inside containers