[docker-sflow] limit privileged flag for sflow container

[maipbui]

Why I did it

HLD implementation: Container Hardening (sonic-net/SONiC#1364)

Work item tracking

• Microsoft ADO (number only): 14807420

How I did it

Reduce linux capabilities in privileged flag

How to verify it

Run sflow sonic-mgmt tests
Check container's settings: Privileged is false and container only has default Linux caps, does not have extended caps.

admin@vlab-01:~$ docker inspect sflow | grep Privi
            "Privileged": false,


admin@vlab-01:~$ docker exec -it sflow bash
root@vlab-01:/# capsh --print
Current: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap=ep
Bounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap

Which release branch to backport (provide reason below if selected)

• 201811
• 201911
• 202006
• 202012
• 202106
• 202111
• 202205
• 202211
• 202305

Tested branch (Please provide the tested image version)

• master.0-de01f2d00

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

[qiluo-msft]

@padmanarayana @mint570 Could you help review?

[vivekrnv]

@maipbui Did you test the change with sflow community tests? or make sure if the pipelines run the sflow tests

[jeff-yin]

Asked @padmanarayana and @Gokulnath-Raja to help review.

[maipbui]

@maipbui Did you test the change with sflow community tests? or make sure if the pipelines run the sflow tests

@vivekrnv Do you mean sflow sonic-mgmt tests? If so, yes

[padmanarayana]

Change looks good.

[Gokulnath-Raja]

Asked @padmanarayana and @Gokulnath-Raja to help review.

I am fine with the changes