update privileged container documentation

[bergwolf]

Which feature do you think can be improved?

With containerd/cri side improvement containerd/cri#1225, and moby side improvement moby/moby#39702, and cri-o side cri-o/cri-o#2708 (which is not handled yet), we should update kata's docs about how privilege container works in kata and how to setup and use the feature properly.

How can it be improved?

Add/update document about kata's privilege container handling.

Namingly, for containerd/cri, we should add privileged_without_host_devices = true to containerd's config.toml, something like

      [plugins.cri.containerd.runtimes.kata]
         runtime_type = "io.containerd.kata.v2"
         privileged_without_host_devices = true

or

      [plugins.cri.containerd.runtimes.katacli]
         runtime_type = "io.containerd.runc.v1"
         privileged_without_host_devices = true
         [plugins.cri.containerd.runtimes.katacli.options]
           NoPivotRoot = false
           NoNewKeyring = false
           ShimCgroup = ""
           IoUid = 0
           IoGid = 0
           BinaryName = "/usr/local/sbin/kata-runtime"
           Root = ""
           CriuPath = ""
           SystemdCgroup = false

And for docker, users can use --security-opt privileged-without-host-devices, something like

docker run -it --runtime kata-runtime --privileged --security-opt privileged-without-host-devices busybox

[bergwolf]

/cc @awprice @zhiminghufighting would you like to drive this one?

[awprice]

/cc @awprice @zhiminghufighting would you like to drive this one?

Yep I'd be happy to do it.

[bergwolf]

@awprice Cool, thanks! Please note the moby one is still wip and the cri-o one is not handled yet. Let's start with containerd/cri and fill the gap later on.

[awprice]

@bergwolf Sounds good to me!