Allow non-root users in OCI to listen to low port numbers

[gwenya]

In docker it is possible since some time ago for non-root users to listen to service ports, which is generally considered to be safe and makes sense for application containers (see moby/moby#41030).

Would it make sense for Incus to also set net.ipv4.ip_unprivileged_port_start to 0 in OCI containers by default?

[stgraber]

Yeah, I think that'd be fine for OCI containers.

Should be rather easy to set through lxc.sysctl in the config.

[stgraber]

@gwenya do you want to do it yourself?

Should be a rather trivial change to driver_lxc.go once you find the OCI logic in there (look for lxc.init.cwd to get you to the right spot).

[gwenya]

I'll try, yeah

[gwenya]

I'm also adding ping capabilities via net.ipv4.ping_group_range same as docker does if that's okay @stgraber

[stgraber]

Yeah, that's fine.

[gwenya]

Fixed by #1706