Support NoNewPrivileges

fixes #117

Signed-off-by: Yanqiang Miao <miao.yanqiang@zte.com.cn>

pkg/server/container_create_test.go

@@ -90,6 +90,7 @@ func getCreateContainerTestData() (*runtime.ContainerConfig, *runtime.PodSandbox
 					DropCapabilities: []string{"CHOWN"},
 				},
 				SupplementalGroups: []int64{1111, 2222},
+				NoNewPrivs:         true,
 			},
 		},
 	}
@@ -146,6 +147,9 @@ func getCreateContainerTestData() (*runtime.ContainerConfig, *runtime.PodSandbox
 		assert.Contains(t, spec.Process.User.AdditionalGids, uint32(1111))
 		assert.Contains(t, spec.Process.User.AdditionalGids, uint32(2222))
 
+		t.Logf("Check no_new_privs")
+		assert.Equal(t, spec.Process.NoNewPrivileges, true)
+
 		t.Logf("Check cgroup path")
 		assert.Equal(t, getCgroupsPath("/test/cgroup/parent", id), spec.Linux.CgroupsPath)