This change adds limited support for container capabilities. It allows a more fine-grained control than priviliged mode does. Fixes #365 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>