capability to pull docker images to host

Question

We've got a docker container running with a mount to /var/run/docker. It's a daemonset pulling an image every day to the host the pod is running on.

containers:
      - name: updater
        image: docker #official docker image
        volumeMounts:
        - name: dockersock
          mountPath: /var/run/docker.sock
        securityContext:
          capabilities:
            drop:
              - all
            add:
              - SYS_ADMIN

It works but the pods are running as SYS_ADMIN.

https://man7.org/linux/man-pages/man7/capabilities.7.html

What is the minimum required capability to be able to pull images through /var/run/docker.sock on the host from a pod?