NET_ADMIN privilege for all containers?

[nphyatt]

Right now all containers are being launched with NET_ADMIN privileges. Do we want this or would we prefer to give it on a container to container basis depending on whether it has been requested or might be neccessary? We should verify giving a container promiscuous mode doesn't cause any security risks.