$ docker run --cap-add SYS_TIME -it ubuntu:16.04 /bin/bash
root@50007999ec5e:/# date --set "+2 hours"
date: cannot set date: Operation not permitted
Thu Jan 1 2:00:00 UTC 1970

$ docker run --security-opt apparmor:unconfined --cap-add SYS_TIME -it ubuntu:16.04 /bin/bash
root@c4d923009bab:/# date --set "+2 hours"
date: cannot set date: Operation not permitted
Thu Jan 1 2:00:00 UTC 1970

$ docker run --privileged -it ubuntu:16.04 /bin/bash
root@35ef33342149:/# date --set "+2 hours"
Thu Jan 1 2:00:00 UTC 1970