Add support for ambient capabilities

Allow setting ambient capabilities, as a seperate option to the standard
ones. If you are running as a non root user you should use these.

Note that unless you add `CAP_DAC_OVERRIDE` and similar permissions you
need to be careful about file ownership. Added support to set ownership
in the `files` section to help out with this.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>

src/moby/schema.go

@@ -24,7 +24,9 @@ var schema = string(`
           "contents": {"type": "string"},
           "source": {"type": "string"},
           "optional": {"type": "boolean"},
-          "mode": {"type": "string"}
+          "mode": {"type": "string"},
+          "uid": {"type": "integer"},
+          "gid": {"type": "integer"}
         }
     },
     "files": {
@@ -65,6 +67,7 @@ var schema = string(`
         "name": {"type": "string"},
         "image": {"type": "string"},
         "capabilities": { "$ref": "#/definitions/strings" },
+        "ambient": { "$ref": "#/definitions/strings" },
         "mounts": { "$ref": "#/definitions/mounts" },
         "binds": { "$ref": "#/definitions/strings" },
         "tmpfs": { "$ref": "#/definitions/strings" },