added capabilities needed by new sysinit

The new sysinit now drops capabilities and sets the hostname instead of LXC - updated sample seccomp list of allowed syscalls for this to work. Also minor fix to help message for correct usage.

Docker-DCO-1.0-Signed-off-by: Fernando Mayo <fernando.mayo@tutum.co> (github: fermayo)