Comment 1 for bug 1901777

I can see how this happens. I'm sure it's not the only issue of this class. From IRC:

one option would be to run the container check even if the service is disabled (but still do the group check). If the container is running but should be disabled, we can stop it.