Use Docker's system call whitelisting features

[DemiMarie]

Docker supports system call whitelisting. This is necessary to protect the kernel from local privilege escalation exploits. This was a major feature of playpen.