dotcloud/docker — pull request #2452 by ewindisch (2013-10-29 19:51:29+00:00)
Title: Support granular capabilities

Rather than only supporting lxc.cap.drop, support
should be added for lxc.cap.keep. This would enable
the principle of deny-by-default, with an ability to
granularly enable capabilities.

Allusion to the necessity for this feature is already
noted in lxc_template.go

Resolves issue #2080