NoNewPrivileges support in docker

[mrunalp]

NoNewPrivileges support was added to the OCI spec and is in the process of being added to runc. The purpose of this issue is to discuss options for integrating this into docker. There are two options:

1. Add a flag to enable this setting optionally.
2. Enable this setting by default for all containers.

Any thoughts?

@crosbymichael @LK4D4 @rhatdan

[rhatdan]

It should definitely be optional, some people might want to run containers with lower privileges but still allow users to sudo or use setuid apps to raise privileges. I think Ping would be broken by turning this on by default at this point.

[mrunalp]

@rhatdan Yes, I agree that is the safer option and won't break existing applications.

[thaJeztah]

Would that be a new option to --security-opt? e.g. --security-opt=no-new-privileges?

[mrunalp]

@thaJeztah That sounds good to me since this is a security setting.

[rhatdan]

SGTM

[tianon]

This was fixed by #20727 😄