give only required permissions to the container

Running Docker containers with --privileged gives a lot of permissions to the container. Minimizing it to CAP_SYS_ADMIN is recommended, even though CAP_SYS_ADMIN is a very permissive kernel capability.  Less is always better, when more is not required.