Temporarily disable CAP_PERFMON, CAP_BPF, and CAP_CHECKPOINT_RESTORE

[thaJeztah]

fixes #41562

This prevents docker from setting CAP_PERFMON, CAP_BPF, and CAP_CHECKPOINT_RESTORE
capabilities on --privileged (or CAP_ALL) containers on Kernel 5.8 and up.

While these kernels support these capabilities, the current release of runc ships with an older version of gocapability/capability, and does not know about them, causing an error to be produced.

We can remove this restriction once opencontainers/runc@6dfbe9b is included in a runc release and once we stop supporting containerd 1.3.x (which ships with runc v1.0.0-rc92).

Thanks to @aiordache for reporting.

- Description for the changelog

- A picture of a cute animal (not mandatory but encouraged)

[thaJeztah]

@AkihiroSuda @cpuguy83 @tiborvass PTAL

[thaJeztah]

FWIW, our CI didn't catch this problem because the current ubuntu LTS version are on kernel < 5.8, therefore docker doesn't set these capabilities when using --privileged (or --cap-add ALL).

I wonder if a long-term solution would be to;

• define what capabilities are allowed to be set in the runtime-spec
• introduce a special ALL capability in the runtime spec, which would make the runtime responsible for giving the container "all" capabilities. That way runtimes will remain compatible

[thaJeztah]

CI will likely fail until #41560 is merged

[thaJeztah]

Rebased to get the fix from #41560 in

[cpuguy83]

This is unfortunate.

[thaJeztah]

Yes, it is; not sure what a better solution is for now (besides hoping on a new runc release soon, and that to be included in containerd 1.3.x)

What do you think of my idea for an ALL capability to be added to the runtime spec to delegate it to runc / the runtime? I can write up a short proposal for that.

[thaJeztah]

opened docker/docker-ce-packaging#506, so that for v20.10, we only have to consider containerd v1.4.x to be updated to a newer runc version