@@ -46,6 +46,7 @@ func installConfigFlags(conf *config.Config, flags *pflag.FlagSet) {

 	flags.Int64Var(&conf.CPURealtimeRuntime, "cpu-rt-runtime", 0, "Limit the CPU real-time runtime in microseconds")

 	flags.StringVar(&conf.SeccompProfile, "seccomp-profile", "", "Path to seccomp profile")

 	flags.Var(&conf.ShmSize, "default-shm-size", "Default shm size for containers")

+	flags.BoolVar(&conf.NoNewPrivileges, "no-new-privileges", false, "Set no-new-privileges by default for new containers")

 	attachExperimentalFlags(conf, flags)

 }

@@ -71,6 +71,7 @@ Options:

       --max-concurrent-uploads int            Set the max concurrent uploads for each push (default 5)

       --metrics-addr string                   Set default address and port to serve the metrics api on

       --mtu int                               Set the containers network MTU

+      --no-new-privileges                     Set no-new-privileges by default for new containers

       --oom-score-adjust int                  Set the oom_score_adj for the daemon (default -500)

   -p, --pidfile string                        Path to use for daemon PID file (default "/var/run/docker.pid")

       --raw-logs                              Full timestamps without ANSI coloring