review and fix capabilities granted to containers

[mmguero]

We need to look at the docker-compose.yml and docker-compose-standalone.yml files and the corresponding kubernetes yaml files and look at the capabilities specified for containers (cap_add in the docker compose files, capabilities in the kubernetes manifests) and review/document which ones are actually required. We don't want to be giving containers privileges that they don't explicitly need.

[mmguero]

I've removed unnecessary capabilities from containers. The ones that remain are requried for the following reasons:

• NET_ADMIN and NET_RAW - to turn on promiscuous mode and capture raw packets
• SYS_NICE - to set process nice values, real-timescheduling policies, I/O scheduling
• IPC_LOCK - to lock memory, preventing swapping
• SYS_RESOURCE - for increasing memlock limits
• SYS_ADMIN - only needed by pcap-capture's netsniff-ng process to set disc I/O scheduler policy; this could be removed locally if tcpdump is used instead, although netsniff-ng performs better

These are limited to containers that are 1) doing memory-intensive stuff or 2) performing packet capture.

I am not seeing any sort of broken or degraded behavior with these changes. Closing for now and will keep an eye on it.