Retain cap_net_admin in container