[docker-nat] limit privileged flag for nat container

[maipbui]

Why I did it

HLD implementation: Container Hardening (sonic-net/SONiC#1364)

Work item tracking

• Microsoft ADO (number only): 14807420

How I did it

Reduce linux capabilities in privileged flag

How to verify it

Check container's settings: Privileged is false and container only has default Linux caps, does not have extended caps.

admin@vlab-01:~$ docker inspect nat | grep Privi
            "Privileged": false,


admin@vlab-01:~$ docker exec -it nat bash
root@vlab-01:/# capsh --print
Current: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap=ep

Which release branch to backport (provide reason below if selected)

• 201811
• 201911
• 202006
• 202012
• 202106
• 202111
• 202205
• 202211
• 202305

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

[qiluo-msft]

@kirankella Could you help review this PR?

[maipbui]

@kirankella @stepanblyschak @abdosi could you help review this PR?

[stepanblyschak]

@maipbui If nat is no longer priviledged does any application inside NAT require at least --cap-add=NET_ADMIN? E.g. for conntrack?

[maipbui]

@maipbui If nat is no longer priviledged does any application inside NAT require at least --cap-add=NET_ADMIN? E.g. for conntrack?

Yes, NAT needs NET_ADMIN for conntrack in restore_nat_entries, thank you

[maipbui]

@stepanblyschak could you help review again?

[qiluo-msft]

@kirankella Could you help review?

[maipbui]

@stepanblyschak @kirankella could you help review?