dotcloud/docker — pull request #6080 by bernerdschaefer (2014-05-28 13:10:55+00:00)
Title: Drop capabilities after changing user/group

At the moment, `nsinit.Init()` will fail if a user is specified in container.json but `CAP_SETGID` and `CAP_SETUID` are not present in the capabilities list.

This changeset drops capabilities after changing the user/group (instead of before), allowing the user to be set without also granting the contained process setuid/gid capabilities.