Install script [here](https://github.com/ClickHouse/ClickHouse/blob/b39c19399ff951a598dd35e575c715c5c4dfb5a2/programs/install/Install.cpp#L764) relies on an old docker behavior that:
`setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /usr/bin/clickhouse`
will fail if container does not support  `cap_net_admin,cap_ipc_lock,cap_sys_nice+ep` capabilities.
But that's not the case in a modern docker:
```
$ docker --version
Docker version 20.10.7, build 20.10.7-0ubuntu5~20.04.2
$ docker run --rm -it ubuntu:20.04 bash
root@36cf1ffd9581:/# (apt update && libcap-ng-utils libcap2-bin -y) >/dev/null 2>&1
root@36cf1ffd9581:/# setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /bin/cp
root@36cf1ffd9581:/# /bin/cp
bash: /bin/cp: Operation not permitted
root@36cf1ffd9581:/# captest --text
User  credentials uid:0 euid:0 suid:0
Group credentials gid:0 egid:0 sgid:0
Effective: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Permitted: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Inheritable: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Bounding Set: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
securebits flags: none
Attempting direct access to shadow...SUCCESS
Attempting to access shadow by child process...SUCCESS
Attempting to regain root...SUCCESS - PRIVILEGE ESCALATION POSSIBLE
Child User  credentials uid:0 euid:0 suid:0
Child Group credentials gid:0 egid:0 sgid:0
Child Effective: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Permitted: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Inheritable: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Bounding Set: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child securebits flags: none
Attempting direct access to shadow...SUCCESS
```

**What can be done?**
It looks like a better check on which caps are available can be concocted.

1. Use `captest`. But it needs `libcap-ng-utils` as dependency.
2. Use `capsh`. But it's kinda old and will complain:
```
root@7ab3e3468a58:/# capsh --has-p=cap_net_admin
WARNING: libcap needs an update (cap=40 should have a name).
cap[cap_net_admin] not permitted
```
3. Other funny option?

fmt::print("Server started\n");
                break;
            }
            sleepForSeconds(1);
        }
        if (try_num == num_tries)
        {
            fmt::print("Cannot start server. You can execute {} without --daemon option to run manually.\n", command);
            fs::path log_path;
            {
                ConfigProcessor processor(config.string(),  false,  false);
                ConfigurationPtr configuration(new Poco::Util::XMLConfiguration(processor.processConfig()));
                if (configuration->has("logger.log"))
                    log_path = fs::path(configuration->getString("logger.log")).remove_filename();
            }
            if (log_path.empty())
            {
                fmt::print("Cannot obtain path to logs (logger.log) from config file {}.\n", config.string());
            }
            else
            {
                fs::path stderr_path = log_path;
                stderr_path.replace_filename("stderr.log");
                fmt::print("Look for logs at {} and for {}.\n", log_path.string(), stderr_path.string());
            }
            return 3;
        }
        return 0;
    }
    UInt64 isRunning(const fs::path & pid_file)