You can that do with docker-compose.

This works for version 2 and 3. For example:

version: '2'
services:
  myapp:
    cap_add:
    - SYS_ADMIN
    - DAC_READ_SEARCH

You can't do that. An image can't grant itself elevated privileges to control the system it runs on; only the administrator actually running the docker run can do that.

It's better to wrap this in something like a Docker Compose YAML file or a shell script that includes all of the required docker run arguments.

If you're trying to build a "helper command" via Docker, there's two things worth remembering. One is that everyone who can run Docker commands has unrestricted root privileges over the host; it's very hard to stop someone from docker run -v /:/host -u root ... and getting unrestricted access to the host's filesystem. Another is that there are many Docker options like this (including setting environment variables, volume mounts, and publishing ports) that are set extremely routinely, so it's hard to build an image where just docker run imagename on its own brings up the image with full functionality.

Write a script like /usr/local/sbin/docker-ping.sh:

#!/bin/sh

docker run --cap-add SYS_ADMIN --cap-add DAC_READ_SEARCH ping

Then another script, /usr/local/bin/docker-ping:

#!/bin/sh

sudo /usr/local/sbin/docker-ping.sh

And finally modify sudo appropriately.

If exist the docker group into the system, probably you don't need to use sudo command. As described on this link, append the group docker, and add your user to the group. That will avoid to use sudo. I have just tested other privileged commands and they worked without any issue for me. Repeating the steps into the above link:

sudo groupadd docker
sudo usermod -aG docker $USER

The docker daemon should be restarted to make effect the above, or restart the machine.

By the way, the focus of your question, the best option is to launch with a shell script as far as I know. It is good the approach indicated previously, but I would write this other one which allow pass arbitrary parameters and is more generic for any command you could need.

File: privileged-wrapper.sh

#!/bin/bash
IMAGE_NAME="your_image_name"
BINARY="$0"
BINARY="${BINARY#./}"
docker run --cap-add SYS_ADMIN --cap-add DAC_READ_SEARCH --rm "$IMAGE_NAME" "$BINARY" "$@"

And now, you can create so many symbolic links as commands you need for those capabilities (keep in mind that the name of the symbolic link is the command to be launched into the container). It is expected the command to be launched is found into the PATH.

chmod a+x privileged-wrapper.sh
ln -svf privileged-wrapper.sh ping

Finally just launch:

./ping -c 10