- Grant capabilities explicitly to backend domain - Next step is change NFS to run in the backend domain