--- lxc/config/altlinux.common.conf.in.alt	2016-09-21 16:12:06.295383628 +0300

+++ lxc/config/altlinux.common.conf.in	2016-09-21 16:19:40.659238948 +0300

@@ -0,0 +1,21 @@

+# This derives from the global common config

+lxc.include = @LXCTEMPLATECONFIG@/common.conf

+

+# Capabilities

+# Uncomment these if you don't run anything that needs the capability, and

+# would like the container to run with less privilege.

+#

+# Dropping sys_admin disables container root from doing a lot of things

+# that could be bad like re-mounting lxc fstab entries rw for example,

+# but also disables some useful things like being able to nfs mount, and

+# things that are already namespaced with ns_capable() kernel checks, like

+# hostname(1).

+# lxc.cap.drop = sys_admin

+# lxc.cap.drop = net_raw          # breaks dhcp/ping

+# lxc.cap.drop = setgid           # breaks login (initgroups/setgroups)

+# lxc.cap.drop = dac_read_search  # breaks login (pam unix_chkpwd)

+# lxc.cap.drop = setuid           # breaks sshd,nfs statd

+# lxc.cap.drop = audit_control    # breaks sshd (set_loginuid failed)

+# lxc.cap.drop = audit_write

+# lxc.cap.drop = setpcap          # big big login delays in Fedora 20 systemd

+lxc.cap.drop = setfcap sys_nice sys_pacct sys_rawio

--- lxc/config/altlinux.userns.conf.in.alt	2016-09-21 16:12:06.329383619 +0300

+++ lxc/config/altlinux.userns.conf.in	2016-09-21 16:19:50.652235762 +0300

@@ -0,0 +1,2 @@

+# This derives from the global userns config

+lxc.include = @LXCTEMPLATECONFIG@/userns.conf