change permissions of dockerinit
moved capabilities drop back to LXC template