Install script [here](https://github.com/ClickHouse/ClickHouse/blob/b39c19399ff951a598dd35e575c715c5c4dfb5a2/programs/install/Install.cpp#L764) relies on an old docker behavior that:
`setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /usr/bin/clickhouse`
will fail if container does not support  `cap_net_admin,cap_ipc_lock,cap_sys_nice+ep` capabilities.
But that's not the case in a modern docker:
```
$ docker --version
Docker version 20.10.7, build 20.10.7-0ubuntu5~20.04.2
$ docker run --rm -it ubuntu:20.04 bash
root@36cf1ffd9581:/# (apt update && libcap-ng-utils libcap2-bin -y) >/dev/null 2>&1
root@36cf1ffd9581:/# setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /bin/cp
root@36cf1ffd9581:/# /bin/cp
bash: /bin/cp: Operation not permitted
root@36cf1ffd9581:/# captest --text
User  credentials uid:0 euid:0 suid:0
Group credentials gid:0 egid:0 sgid:0
Effective: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Permitted: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Inheritable: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Bounding Set: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
securebits flags: none
Attempting direct access to shadow...SUCCESS
Attempting to access shadow by child process...SUCCESS
Attempting to regain root...SUCCESS - PRIVILEGE ESCALATION POSSIBLE
Child User  credentials uid:0 euid:0 suid:0
Child Group credentials gid:0 egid:0 sgid:0
Child Effective: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Permitted: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Inheritable: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Bounding Set: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child securebits flags: none
Attempting direct access to shadow...SUCCESS
```

**What can be done?**
It looks like a better check on which caps are available can be concocted.

1. Use `captest`. But it needs `libcap-ng-utils` as dependency.
2. Use `capsh`. But it's kinda old and will complain:
```
root@7ab3e3468a58:/# capsh --has-p=cap_net_admin
WARNING: libcap needs an update (cap=40 should have a name).
cap[cap_net_admin] not permitted
```
3. Other funny option?

fs::create_directories(pid_path);
            
            fs::permissions(pid_path, fs::perms::owner_all | fs::perms::group_read | fs::perms::others_read, fs::perm_options::replace);
            changeOwnership(pid_path, user);
        }
        std::string command = fmt::format("{} --config-file {} --pid-file {} --daemon",
            executable.string(), config.string(), pid_file.string());
        if (!user.empty())
        {
            bool may_need_sudo = geteuid() != 0;
            if (may_need_sudo)
            {
                struct passwd *p = getpwuid(geteuid());
                
                if (p == nullptr || std::string(p->pw_name) != user)
                    command = fmt::format("sudo -u '{}' {}", user, command);
            }
            else
                command = fmt::format("su -s /bin/sh '{}' -c '{}'", user, command);
        }
        fmt::print("Will run {}\n", command);
        executeScript(command, true);
        
        size_t try_num = 0;
        constexpr size_t num_tries = 60;
        for (; try_num < num_tries; ++try_num)
        {
            fmt::print("Waiting for server to start\n");
            if (fs::exists(pid_file))
            {