Install script [here](https://github.com/ClickHouse/ClickHouse/blob/b39c19399ff951a598dd35e575c715c5c4dfb5a2/programs/install/Install.cpp#L764) relies on an old docker behavior that:
`setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /usr/bin/clickhouse`
will fail if container does not support  `cap_net_admin,cap_ipc_lock,cap_sys_nice+ep` capabilities.
But that's not the case in a modern docker:
```
$ docker --version
Docker version 20.10.7, build 20.10.7-0ubuntu5~20.04.2
$ docker run --rm -it ubuntu:20.04 bash
root@36cf1ffd9581:/# (apt update && libcap-ng-utils libcap2-bin -y) >/dev/null 2>&1
root@36cf1ffd9581:/# setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /bin/cp
root@36cf1ffd9581:/# /bin/cp
bash: /bin/cp: Operation not permitted
root@36cf1ffd9581:/# captest --text
User  credentials uid:0 euid:0 suid:0
Group credentials gid:0 egid:0 sgid:0
Effective: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Permitted: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Inheritable: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Bounding Set: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
securebits flags: none
Attempting direct access to shadow...SUCCESS
Attempting to access shadow by child process...SUCCESS
Attempting to regain root...SUCCESS - PRIVILEGE ESCALATION POSSIBLE
Child User  credentials uid:0 euid:0 suid:0
Child Group credentials gid:0 egid:0 sgid:0
Child Effective: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Permitted: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Inheritable: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Bounding Set: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child securebits flags: none
Attempting direct access to shadow...SUCCESS
```

**What can be done?**
It looks like a better check on which caps are available can be concocted.

1. Use `captest`. But it needs `libcap-ng-utils` as dependency.
2. Use `capsh`. But it's kinda old and will complain:
```
root@7ab3e3468a58:/# capsh --has-p=cap_net_admin
WARNING: libcap needs an update (cap=40 should have a name).
cap[cap_net_admin] not permitted
```
3. Other funny option?

#include <IO/ReadBufferFromFileDescriptor.h>
#include <IO/WriteBufferFromFileDescriptor.h>
#include <IO/ReadBufferFromFile.h>
#include <IO/WriteBufferFromFile.h>
#include <IO/MMapReadBufferFromFile.h>
#include <IO/ReadBufferFromMemory.h>
#include <IO/copyData.h>
#include <IO/Operators.h>
#include <readpassphrase.h>
#include <Poco/Util/XMLConfiguration.h>
/** This tool can be used to install ClickHouse without a deb/rpm/tgz package, having only "clickhouse" binary.
  * It also allows to avoid dependency on systemd, upstart, SysV init.
  *
  * The following steps are performed:
  *
  * - copying the binary to binary directory (/usr/bin).
  * - creation of symlinks for tools.
  * - creation of clickhouse user and group.
  * - creation of config directory (/etc/clickhouse-server).
  * - creation of default configuration files.
  * - creation of a directory for logs (/var/log/clickhouse-server).
  * - creation of a data directory if not exists.
  * - setting a password for default user.
  * - choose an option to listen connections.
  * - changing the ownership and mode of the directories.
  * - setting capabilities for binary.
  * - setting ulimits for the user.
  * - (todo) put service in cron.
  *
  * It does not install clickhouse-odbc-bridge.