Janitor needs neither privileged mode nor network access. (#100)

* Janitor doen't need privileged mode nor networking

- remove "privileged: true" property
- add "net: none" property

The cleanup tasks runs entirely without networking on /var/run/docker.sock. The calling process can access the docker so it does not need to have privileged mode.

Signed-off-by: Mathias Kaufmann <me@stei.gr>

* Added boolean question for privileged mode.

Signed-off-by: Mathias Kaufmann <me@stei.gr>

templates/janitor/2/docker-compose.yml

@@ -10,7 +10,8 @@ cleanup:
   labels:
      io.rancher.scheduler.global: "true"
      io.rancher.scheduler.affinity:host_label_ne: "${EXCLUDE_LABEL}"
-  privileged: true
+  net: none
+  privileged: ${PRIVILEGED_MODE}
   tty: false
   stdin_open: false
   volumes: