robustify isolation

[parmentelat]

Consider the following actions for improving security

• --cap-drop=all ou a minima --cap-drop=MKNOD (capabilities supported in docker 1.2)
  et aussi --cap-drop=NET_RAW

• Note that since 1.10, there is also support of seccomp-bpf - fine-grained access control to kernel syscalls; this should be fine

• mount all volumes with -o nosuid

• verify if the global docker option -icc=false; enable this if it does not break anything (should not)

• double check why on earth we insert all users in the docker group