Install script [here](https://github.com/ClickHouse/ClickHouse/blob/b39c19399ff951a598dd35e575c715c5c4dfb5a2/programs/install/Install.cpp#L764) relies on an old docker behavior that:
`setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /usr/bin/clickhouse`
will fail if container does not support  `cap_net_admin,cap_ipc_lock,cap_sys_nice+ep` capabilities.
But that's not the case in a modern docker:
```
$ docker --version
Docker version 20.10.7, build 20.10.7-0ubuntu5~20.04.2
$ docker run --rm -it ubuntu:20.04 bash
root@36cf1ffd9581:/# (apt update && libcap-ng-utils libcap2-bin -y) >/dev/null 2>&1
root@36cf1ffd9581:/# setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /bin/cp
root@36cf1ffd9581:/# /bin/cp
bash: /bin/cp: Operation not permitted
root@36cf1ffd9581:/# captest --text
User  credentials uid:0 euid:0 suid:0
Group credentials gid:0 egid:0 sgid:0
Effective: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Permitted: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Inheritable: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Bounding Set: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
securebits flags: none
Attempting direct access to shadow...SUCCESS
Attempting to access shadow by child process...SUCCESS
Attempting to regain root...SUCCESS - PRIVILEGE ESCALATION POSSIBLE
Child User  credentials uid:0 euid:0 suid:0
Child Group credentials gid:0 egid:0 sgid:0
Child Effective: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Permitted: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Inheritable: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Bounding Set: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child securebits flags: none
Attempting direct access to shadow...SUCCESS
```

**What can be done?**
It looks like a better check on which caps are available can be concocted.

1. Use `captest`. But it needs `libcap-ng-utils` as dependency.
2. Use `capsh`. But it's kinda old and will complain:
```
root@7ab3e3468a58:/# capsh --has-p=cap_net_admin
WARNING: libcap needs an update (cap=40 should have a name).
cap[cap_net_admin] not permitted
```
3. Other funny option?

changeOwnership(data_path, user, group,  false);
        
        fs::permissions(pid_path, fs::perms::owner_all | fs::perms::group_read | fs::perms::others_read, fs::perm_options::replace);
        
        fs::permissions(log_path, fs::perms::owner_all | fs::perms::group_all, fs::perm_options::replace);
        
        fs::permissions(data_path, fs::perms::owner_all, fs::perm_options::replace);
        fs::path odbc_bridge_path = bin_dir / "clickhouse-odbc-bridge";
        fs::path library_bridge_path = bin_dir / "clickhouse-library-bridge";
        if (fs::exists(odbc_bridge_path) || fs::exists(library_bridge_path))
        {
            createGroup(DEFAULT_CLICKHOUSE_BRIDGE_GROUP);
            createUser(DEFAULT_CLICKHOUSE_BRIDGE_USER, DEFAULT_CLICKHOUSE_BRIDGE_GROUP);
            if (fs::exists(odbc_bridge_path))
                changeOwnership(odbc_bridge_path, DEFAULT_CLICKHOUSE_BRIDGE_USER, DEFAULT_CLICKHOUSE_BRIDGE_GROUP);
            if (fs::exists(library_bridge_path))
                changeOwnership(library_bridge_path, DEFAULT_CLICKHOUSE_BRIDGE_USER, DEFAULT_CLICKHOUSE_BRIDGE_GROUP);
        }
        bool stdin_is_a_tty = isatty(STDIN_FILENO);
        bool stdout_is_a_tty = isatty(STDOUT_FILENO);
        
        const char * debian_frontend_var = getenv("DEBIAN_FRONTEND");
        bool noninteractive = debian_frontend_var && debian_frontend_var == std::string_view("noninteractive");
        bool is_interactive = !noninteractive && stdin_is_a_tty && stdout_is_a_tty;
        
        bool can_ask_password = !noninteractive && stdout_is_a_tty;
        
        if (has_password_for_default_user)
        {