Install script [here](https://github.com/ClickHouse/ClickHouse/blob/b39c19399ff951a598dd35e575c715c5c4dfb5a2/programs/install/Install.cpp#L764) relies on an old docker behavior that:
`setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /usr/bin/clickhouse`
will fail if container does not support  `cap_net_admin,cap_ipc_lock,cap_sys_nice+ep` capabilities.
But that's not the case in a modern docker:
```
$ docker --version
Docker version 20.10.7, build 20.10.7-0ubuntu5~20.04.2
$ docker run --rm -it ubuntu:20.04 bash
root@36cf1ffd9581:/# (apt update && libcap-ng-utils libcap2-bin -y) >/dev/null 2>&1
root@36cf1ffd9581:/# setcap 'cap_net_admin,cap_ipc_lock,cap_sys_nice+ep' /bin/cp
root@36cf1ffd9581:/# /bin/cp
bash: /bin/cp: Operation not permitted
root@36cf1ffd9581:/# captest --text
User  credentials uid:0 euid:0 suid:0
Group credentials gid:0 egid:0 sgid:0
Effective: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Permitted: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Inheritable: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Bounding Set: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
securebits flags: none
Attempting direct access to shadow...SUCCESS
Attempting to access shadow by child process...SUCCESS
Attempting to regain root...SUCCESS - PRIVILEGE ESCALATION POSSIBLE
Child User  credentials uid:0 euid:0 suid:0
Child Group credentials gid:0 egid:0 sgid:0
Child Effective: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Permitted: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Inheritable: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child Bounding Set: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap
Child securebits flags: none
Attempting direct access to shadow...SUCCESS
```

**What can be done?**
It looks like a better check on which caps are available can be concocted.

1. Use `captest`. But it needs `libcap-ng-utils` as dependency.
2. Use `capsh`. But it's kinda old and will complain:
```
root@7ab3e3468a58:/# capsh --has-p=cap_net_admin
WARNING: libcap needs an update (cap=40 should have a name).
cap[cap_net_admin] not permitted
```
3. Other funny option?

{
#if defined(OS_DARWIN)
                
#else
                fs::path ulimits_dir = "/etc/security/limits.d";
                fs::path ulimits_file = ulimits_dir / fmt::format("{}.conf", user);
                fmt::print("Will set ulimits for {} user in {}.\n", user, ulimits_file.string());
                std::string ulimits_content = fmt::format(
                    "{0}\tsoft\tnofile\t262144\n"
                    "{0}\thard\tnofile\t262144\n", user);
                fs::create_directories(ulimits_dir);
                WriteBufferFromFile out(ulimits_file.string());
                out.write(ulimits_content.data(), ulimits_content.size());
                out.sync();
                out.finalize();
#endif
            }
            catch (...)
            {
                std::cerr << "Cannot set ulimits: " << getCurrentExceptionMessage(false) << "\n";
            }
        }
        else
            fmt::print("Will not create a dedicated clickhouse user.\n");
        
        fs::path config_dir = prefix / options["config-path"].as<std::string>();
        if (!fs::exists(config_dir))
        {
            fmt::print("Creating config directory {}.\n", config_dir.string());
            fs::create_directories(config_dir);