NoNewPrivileges support was added to the OCI spec and is in the process of being added to runc. The purpose of this issue is to discuss options for integrating this into docker. There are two options:

1. Add a flag to enable this setting optionally.
2. Enable this setting by default for all containers.

Any thoughts?

@crosbymichael @LK4D4 @rhatdan