fix(client): Use libcap to fix icmp not working in containers as non-root

[thequailman]

Summary

Fixes #697

This PR modifies the Gatus binary in the container to have the CAP_NET_RAW capability. Gatus can now perform ICMP monitoring without running as a privileged or root container.

Checklist

• Tested and/or added tests to validate that the changes work as intended, if applicable.
• Updated documentation in README.md, if applicable.

[TwiN]

Looks like this is causing an issue: #1057

I may have to revert this if we can't find a fix

[thequailman]

I think there are three options here:

• Require CAP_NET_RAW since gatus doesn't fully work without it as non-root (Go ping requires it). Folks may not be using ping, but the capability doesn't really decrease security that much.
• Have two gatus container image tags, one with the cap added, one without
• Make the setcap step conditional at runtime by adding a shell and cap tooling to the container and have an entrypoint script that conditionally performs setcap. This will increase the size of the container and the attack surface, IMO.

[thequailman]

FWIW, Docker enables CAP_NET_RAW by default

Telegraf had a similar situation and required CAP_NET_RAW for podman folks

[TwiN]

The chaotic inside of me just makes me feel like having those using podman deal with it, mostly because podman users are a minority.

[TwiN]

Based on what I'm seeing on containerd/containerd#10434, it seems like CAP_NET_RAW being enabled by default may be changed in the future.

I wonder if the current default behavior is why Gatus worked just fine for me on Kubernetes even before this change?

[dkowis]

I don't mind that it would be documented for podman users. As a podman user, I'm fine with that :) It seems reasonable to me.