The *apply-config-policy* service does what it says on the tin. It
fetches the *cfg.git* repository and applies the configuration policy
therein for the current host. This is a privileged container with
practically allisolation disabled, to allow the configuration tools to
manage the system.
