drop NET_RAW from all containers

Signed-off-by: Simon L <szaimen@e.mail.de>

php/src/Docker/DockerActionManager.php

@@ -476,6 +476,9 @@ class DockerActionManager
             $requestBody['HostConfig']['CapAdd'] = $capAdds;
         }
 
+        // Disable arp spoofing
+        $requestBody['HostConfig']['CapDrop'] = ['NET_RAW'];
+
         if ($container->isApparmorUnconfined()) {
             $requestBody['HostConfig']['SecurityOpt'] = ["apparmor:unconfined"];
         }