Another possible approach is to disable the console directly from the container at runtime using dbus. Posted my findings here: