diff --git a/etc/openqa/workers.ini b/etc/openqa/workers.ini
index 33efb76f119..9dada3ac7e0 100644
--- a/etc/openqa/workers.ini
+++ b/etc/openqa/workers.ini
@@ -1,20 +1,17 @@
 # Configuration of the workers and their backends.
 #
-# The section id's are the instance id's of the workers.
-# The key/value pairs will be added to $job->{"settings"}
-# and will appear as env vars in the testmodules.
+# The section ids are the instance of the workers.
+# The key/value pairs will be added to $job->{settings}
+# and will appear in vars.json in the jobs.
 #
-# The backend is selected by setting the BACKEND variable.
-# It will default to qemu, if not set.
-
 #[global]
-#BACKEND = qemu
+# where the webui is hosted (if not localhost)
 #HOST = http://openqa.example.com
+# if your /var/lib/openqa/share is slow, enable it
+#CACHEDIRECTORY = /var/lib/openqa/cache
 
 #[1]
-#BACKEND = kvm2usb
-#HW = 1
-#HWSLOT = ix64ph1020
+#WORKER_CLASS = 64bit-ipmi
 
 #[2]
-#BACKEND = vbox
+#WORKER_CLASS = qemu_x86_64_staging,qemu_x86_64
diff --git a/profiles/apparmor.d/usr.share.openqa.script.worker b/profiles/apparmor.d/usr.share.openqa.script.worker
index b4441d212e3..6cf843af78b 100644
--- a/profiles/apparmor.d/usr.share.openqa.script.worker
+++ b/profiles/apparmor.d/usr.share.openqa.script.worker
@@ -1,3 +1,5 @@
+#include <tunables/global>
+
 # ------------------------------------------------------------------
 #
 #    Copyright (C) 2015 SUSE Linux GmbH
@@ -8,9 +10,9 @@
 #
 # ------------------------------------------------------------------
 
-#include <tunables/global>
 
 /usr/share/openqa/script/worker {
+  #include <abstractions/X>
   #include <abstractions/base>
   #include <abstractions/bash>
   #include <abstractions/nameservice>
@@ -26,16 +28,16 @@
   /dev/ r,
   /dev/bus/usb/ r,
   /dev/kvm rw,
+  /dev/net/tun rw,
   /dev/ptmx rw,
   /dev/pts/* rw,
   /dev/tty rw,
-  /dev/net/tun rw,
   /etc/libnl/classid r,
   /etc/openqa/client.conf r,
   /etc/openqa/workers.ini r,
   /etc/qemu/* r,
-  /etc/vde2/vdecmd r,
   /etc/udev/udev.conf r,
+  /etc/vde2/vdecmd r,
   /proc/*/auxv r,
   /proc/*/mountinfo r,
   /proc/*/net/psched r,
@@ -56,21 +58,20 @@
   /tmp/* rwk,
   /usr/bin/Xvnc rCx,
   /usr/bin/cat rix,
+  /usr/bin/cksum rix,
   /usr/bin/cp rix,
   /usr/bin/date rix,
   /usr/bin/dirname rix,
   /usr/bin/eatmydata rix,
+  /usr/bin/flock rix,
   /usr/bin/git rix,
   /usr/bin/gzip rix,
-  /usr/bin/cksum rix,
+  /usr/bin/ionice rix,
   /usr/bin/ipmitool rix,
-  /usr/sbin/ipmiconsole rix,
   /usr/bin/isotovideo rix,
   /usr/bin/lscpu rix,
   /usr/bin/mkdir rix,
-  /usr/bin/snd2png rix,
   /usr/bin/nice rix,
-  /usr/bin/ionice rix,
   /usr/bin/optipng rix,
   /usr/bin/qemu-img rix,
   /usr/bin/qemu-kvm rix,
@@ -79,25 +80,25 @@
   /usr/bin/rsync rix,
   /usr/bin/sha1sum rix,
   /usr/bin/slirpvde rix,
+  /usr/bin/snd2png rix,
   /usr/bin/ssh-keygen rix,
   /usr/bin/tail rix,
   /usr/bin/tee rix,
   /usr/bin/uname rix,
   /usr/bin/unixcmd rix,
   /usr/bin/x3270 cx,
-  /usr/lib/git/git rix,
   /usr/lib*/qemu/block-curl.so rix,
   /usr/lib*/qemu/block-rbd.so mr,
-  /usr/lib/os-autoinst/backend/s390x/vars.json.py rcx,
-  /usr/lib/os-autoinst/tools/absolutize rix,
   /usr/lib/os-autoinst/videoencoder rix,
   /usr/lib/utempter/utempter rix,
+  /usr/sbin/ipmiconsole rix,
   /usr/share/openqa/lib/DBIx/Class/Timestamps.pm r,
   /usr/share/openqa/lib/OpenQA/** r,
   /usr/share/openqa/lib/db_helpers.pm r,
   /usr/share/openqa/script/worker r,
   /usr/share/qemu/* r,
   /usr/share/qemu/keymaps/* r,
+  /var/lib/openqa/cache/** rwk,
   /var/lib/openqa/pool/ r,
   /var/lib/openqa/pool/*/ r,
   /var/lib/openqa/pool/*/** rwk,