[docker-restapi] limit privileged flag for restapi container

[maipbui]

Why I did it

HLD implementation: Container Hardening (sonic-net/SONiC#1364)

Work item tracking

• Microsoft ADO (number only): 14807420

How I did it

Reduce linux capabilities in privileged flag

How to verify it

Run restapi sonic-mgmt tests on sn4600c
Check container's settings: Privileged is false and container only has default Linux caps, does not have extended caps.

admin@vlab-01:~$ docker inspect restapi | grep Privi
            "Privileged": false,


admin@vlab-01:~$ docker exec -it restapi bash
root@vlab-01:/# capsh --print
Current: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap=ep

Which release branch to backport (provide reason below if selected)

• 201811
• 201911
• 202006
• 202012
• 202106
• 202111
• 202205
• 202211
• 202305

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

[maipbui]

@prsunny Could you help review this PR?

[maipbui]

@prsunny @theasianpianist Could you help review this PR?

[xumia]

LGTM

[prsunny]

@xumia , does this break older branches?

[xumia]

@xumia , does this break older branches?

@prsunny , you mean old releases, such as 202305, 202205, right? The PR only goes to master, it should not break older branches, right? @maipbui , please help investigate it, if we need to merge to the older branch.

[maipbui]

@xumia , does this break older branches?

We don’t need to merge to older branches so it should not break older branches.