Repository: localstack/localstack

Issue:
bug: Error when invoking lambda if the `LAMBDA_DOCKER_FLAGS` is specified (Localstack 2.1.0)
### Is there an existing issue for this?

- [X] I have searched the existing issues

### Current Behavior

Error when invoking lambda if the `LAMBDA_DOCKER_FLAGS` is specified

### Expected Behavior

_No response_

### How are you starting LocalStack?

With a `docker run` command

### Steps To Reproduce

#### How are you starting localstack (e.g., `bin/localstack` command, arguments, or `docker-compose.yml`)
```shell
CONTAINER=$(docker run -d --rm \
        -v "$(pwd)":/hello \
        -v /var/run/docker.sock:/var/run/docker.sock \
        -e DEBUG=1 \
        -e DOCKER_HOST="$BITBUCKET_DOCKER_HOST_INTERNAL":2375 \
        -e LAMBDA_DOCKER_FLAGS="-e HELLO=hello" \     # Error cause!
        localstack/localstack:2.1.0)
```

#### Client commands (e.g., AWS SDK code snippet, or sequence of "awslocal" commands)
```shell
docker exec "$CONTAINER" awslocal lambda create-function --function-name testlambda --role arn:aws:iam::000000000000:role/DummyRole --runtime java11 --handler com.atlassian.lambda.demo.SNSEventLambdaHandler --zip-file fileb:///hello/dx-ref-java-lambda.jar --memory-size 1024 --timeout 20
docker exec "$CONTAINER" awslocal lambda publish-version --function-name testlambda
sleep 3

docker exec "$CONTAINER" awslocal lambda invoke --function-name testlambda --invocation-type RequestResponse out
```
In error message you will see the following:
```
2023-06-07T15:41:14.603  WARN --- [t-lambda:1_0] l.u.c.container_client     : Overwriting Docker container privileged flag None with new value False
2023-06-07T15:41:14.609  WARN --- [t-lambda:1_0] l.s.a.i.runtime_environmen : Failed to start runtime environment for ID=42aed13409971175bbb22c9c3d171517 with: 
Traceback (most recent call last):
  File "/opt/code/localstack/.venv/lib/python3.10/site-packages/docker/api/client.py", line 268, in _raise_for_status
    response.raise_for_status()
  File "/opt/code/localstack/.venv/lib/python3.10/site-packages/requests/models.py", line 1021, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: http://10.39.159.168:2375/v1.41/containers/create?name=test-service-default-ab689411-localstack-1-lambda-environment-test-lambda-42aed13409971175bbb22c9c3d171517&platform=linux%2Famd64
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
  File "/opt/code/localstack/localstack/utils/container_utils/docker_sdk_client.py", line 676, in create_container
    container = create_container()
  File "/opt/code/localstack/localstack/utils/container_utils/docker_sdk_client.py", line 657, in create_container
    return self.client().containers.create(
  File "/opt/code/localstack/.venv/lib/python3.10/site-packages/docker/models/containers.py", line 906, in create
    resp = self.client.api.create_container(**create_kwargs)
  File "/opt/code/localstack/.venv/lib/python3.10/site-packages/docker/api/container.py", line 431, in create_container
    return self.create_container_from_config(config, name, platform)
  File "/opt/code/localstack/.venv/lib/python3.10/site-packages/docker/api/container.py", line 448, in create_container_from_config
    return self._result(res, True)
  File "/opt/code/localstack/.venv/lib/python3.10/site-packages/docker/api/client.py", line 274, in _result
    self._raise_for_status(response)
  File "/opt/code/localstack/.venv/lib/python3.10/site-packages/docker/api/client.py", line 270, in _raise_for_status
    raise create_api_error_from_http_exception(e) from e
  File "/opt/code/localstack/.venv/lib/python3.10/site-packages/docker/errors.py", line 39, in create_api_error_from_http_exception
    raise cls(e, response=response, explanation=explanation) from e
docker.errors.APIError: 403 Client Error for http://10.39.159.168:2375/v1.41/containers/create?name=test-service-default-ab689411-localstack-1-lambda-environment-test-lambda-42aed13409971175bbb22c9c3d171517&platform=linux%2Famd64: Forbidden ("authorization denied by plugin pipelines: --privileged=true is not allowed")
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
  File "/opt/code/localstack/localstack/services/awslambda/invocation/runtime_environment.py", line 172, in start
    self.runtime_executor.start(self.get_environment_variables())
  File "/opt/code/localstack/localstack/services/awslambda/invocation/docker_runtime_executor.py", line 314, in start
    CONTAINER_CLIENT.create_container_from_config(container_config)
  File "/opt/code/localstack/localstack/utils/container_utils/container_client.py", line 753, in create_container_from_config
    return self.create_container(
  File "/opt/code/localstack/localstack/utils/container_utils/docker_sdk_client.py", line 685, in create_container
    raise ContainerException() from e
localstack.utils.container_utils.container_client.ContainerException
```
which is caused by:
```python
if args.privileged is not None:
            LOG.warning(
                f"Overwriting Docker container privileged flag {privileged} with new value {args.privileged}"
            )
            privileged = True
```
in `localstack.utils.container_utils.container_client.Util.parse_additional_flags`

#### Also note that error `Overwriting Docker container privileged flag None with new value False` itself is misleading 


### Environment

```markdown
- OS:Mac/darwin
- LocalStack:2.1.0, 2.0.x, latest
```


### Anything else?

_No response_


Discussion:

Resolving patch:
diff --git a/localstack/utils/container_utils/container_client.py b/localstack/utils/container_utils/container_client.py
--- a/localstack/utils/container_utils/container_client.py
+++ b/localstack/utils/container_utils/container_client.py
@@ -1094,11 +1094,11 @@ def parse_additional_flags(
             )
             platform = args.platform
 
-        if args.privileged is not None:
+        if args.privileged:
             LOG.warning(
                 f"Overwriting Docker container privileged flag {privileged} with new value {args.privileged}"
             )
-            privileged = True
+            privileged = args.privileged
 
         if args.publish_ports:
             for port_mapping in args.publish_ports:


Test patch:
diff --git a/tests/unit/test_dockerclient.py b/tests/unit/test_dockerclient.py
--- a/tests/unit/test_dockerclient.py
+++ b/tests/unit/test_dockerclient.py
@@ -186,6 +186,9 @@ def test_privileged(self):
         argument_string = r"--privileged"
         flags = Util.parse_additional_flags(argument_string)
         assert flags.privileged
+        argument_string = ""
+        flags = Util.parse_additional_flags(argument_string)
+        assert not flags.privileged
 
     def test_ulimits(self):
         argument_string = r"--ulimit nofile=1024"