feat(actor-template): per-container securityContext

cmd/ateapi/internal/controlapi/workflow_resume.go

@@ -187,6 +187,21 @@ func (s *CallAteletRestoreStep) Execute(ctx context.Context, input *ResumeInput,
 			}
 			ateletCtr.Env = append(ateletCtr.Env, ateletEnv)
 		}
+		if sc := ctr.SecurityContext; sc != nil {
+			pbsc := &ateletpb.SecurityContext{}
+			if sc.Capabilities != nil {
+				pbsc.Capabilities = &ateletpb.Capabilities{
+					Add: sc.Capabilities.Add,
+				}
+			}
+			if sc.RunAsUser != nil {
+				pbsc.RunAsUser = *sc.RunAsUser
+			}
+			if sc.RunAsGroup != nil {
+				pbsc.RunAsGroup = *sc.RunAsGroup
+			}
+			ateletCtr.SecurityContext = pbsc
+		}
 		workloadSpec.Containers = append(workloadSpec.Containers, ateletCtr)
 	}
 

cmd/ateapi/internal/controlapi/workflow_suspend.go

@@ -160,6 +160,21 @@ func (s *CallAteletSuspendStep) Execute(ctx context.Context, input *SuspendInput
 			}
 			ateletCtr.Env = append(ateletCtr.Env, ateletEnv)
 		}
+		if sc := ctr.SecurityContext; sc != nil {
+			pbsc := &ateletpb.SecurityContext{}
+			if sc.Capabilities != nil {
+				pbsc.Capabilities = &ateletpb.Capabilities{
+					Add: sc.Capabilities.Add,
+				}
+			}
+			if sc.RunAsUser != nil {
+				pbsc.RunAsUser = *sc.RunAsUser
+			}
+			if sc.RunAsGroup != nil {
+				pbsc.RunAsGroup = *sc.RunAsGroup
+			}
+			ateletCtr.SecurityContext = pbsc
+		}
 		req.Spec.Containers = append(req.Spec.Containers, ateletCtr)
 	}
 	_, err = client.Checkpoint(ctx, req)

cmd/atelet/main.go

@@ -390,6 +390,8 @@ func (s *AteomHerder) Run(ctx context.Context, req *ateletpb.RunRequest) (*atele
 			req.GetSpec().GetPauseImage(),
 			[]string{"/pause"},
 			nil,
+			nil,  // pause container uses the default sandbox cap set only
+			0, 0, // pause container always runs as root
 			map[string]string{
 				"io.kubernetes.cri.container-type": "sandbox",
 				"io.kubernetes.cri.container-name": "pause",
@@ -408,6 +410,9 @@ func (s *AteomHerder) Run(ctx context.Context, req *ateletpb.RunRequest) (*atele
 		for _, env := range ctr.GetEnv() {
 			envs = append(envs, fmt.Sprintf("%s=%s", env.GetName(), env.GetValue()))
 		}
+		capAdds := ctr.GetSecurityContext().GetCapabilities().GetAdd()
+		runAsUser := ctr.GetSecurityContext().GetRunAsUser()
+		runAsGroup := ctr.GetSecurityContext().GetRunAsGroup()
 
 		g.Go(func() error {
 			if err := prepareOCIDirectory(
@@ -420,6 +425,8 @@ func (s *AteomHerder) Run(ctx context.Context, req *ateletpb.RunRequest) (*atele
 				ctr.GetImage(),
 				ctr.GetCommand(),
 				envs,
+				capAdds,
+				runAsUser, runAsGroup,
 				map[string]string{
 					"io.kubernetes.cri.container-type": "container",
 					"io.kubernetes.cri.sandbox-id":     "pause",
@@ -639,6 +646,8 @@ func (s *AteomHerder) Restore(ctx context.Context, req *ateletpb.RestoreRequest)
 			req.GetSpec().GetPauseImage(),
 			[]string{"/pause"},
 			nil,
+			nil,  // pause container uses the default sandbox cap set only
+			0, 0, // pause container always runs as root
 			map[string]string{
 				"io.kubernetes.cri.container-type": "sandbox",
 				"io.kubernetes.cri.container-name": "pause",
@@ -657,6 +666,9 @@ func (s *AteomHerder) Restore(ctx context.Context, req *ateletpb.RestoreRequest)
 		for _, env := range ctr.GetEnv() {
 			envs = append(envs, fmt.Sprintf("%s=%s", env.GetName(), env.GetValue()))
 		}
+		capAdds := ctr.GetSecurityContext().GetCapabilities().GetAdd()
+		runAsUser := ctr.GetSecurityContext().GetRunAsUser()
+		runAsGroup := ctr.GetSecurityContext().GetRunAsGroup()
 
 		g.Go(func() error {
 			if err := prepareOCIDirectory(
@@ -669,6 +681,8 @@ func (s *AteomHerder) Restore(ctx context.Context, req *ateletpb.RestoreRequest)
 				ctr.GetImage(),
 				ctr.GetCommand(),
 				envs,
+				capAdds,
+				runAsUser, runAsGroup,
 				map[string]string{
 					"io.kubernetes.cri.container-type": "container",
 					"io.kubernetes.cri.sandbox-id":     "pause",

cmd/atelet/oci.go

@@ -25,6 +25,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"strings"
 
 	"github.com/agent-substrate/substrate/internal/ateompath"
 	"github.com/agent-substrate/substrate/internal/memorypullcache"
@@ -33,7 +34,48 @@ import (
 	"go.opentelemetry.io/otel/attribute"
 )
 
-func prepareOCIDirectory(ctx context.Context, pullCache *memorypullcache.MemoryPullCache, actorTemplateNamespace, actorTemplateName, actorID, containerName, ref string, args []string, env []string, annotations map[string]string, netns string) error {
+// defaultSandboxCapabilities is the unconditional baseline cap set applied
+// to every OCI bundle. Callers may add to it via `capAdds`; the pause
+// container always uses this set unmodified.
+var defaultSandboxCapabilities = []string{
+	"CAP_AUDIT_WRITE",
+	"CAP_KILL",
+	"CAP_NET_BIND_SERVICE",
+}
+
+// resolveCapabilities merges the default sandbox cap set with the
+// caller-requested adds, normalising each entry to its `CAP_…` form so
+// templates may write either `NET_ADMIN` or `CAP_NET_ADMIN`. Duplicates
+// are de-duplicated; ordering is stable (defaults first, then adds in the
+// order supplied).
+func resolveCapabilities(capAdds []string) []string {
+	seen := make(map[string]struct{}, len(defaultSandboxCapabilities)+len(capAdds))
+	out := make([]string, 0, len(defaultSandboxCapabilities)+len(capAdds))
+	for _, c := range defaultSandboxCapabilities {
+		if _, ok := seen[c]; ok {
+			continue
+		}
+		seen[c] = struct{}{}
+		out = append(out, c)
+	}
+	for _, c := range capAdds {
+		c = strings.ToUpper(strings.TrimSpace(c))
+		if c == "" {
+			continue
+		}
+		if !strings.HasPrefix(c, "CAP_") {
+			c = "CAP_" + c
+		}
+		if _, ok := seen[c]; ok {
+			continue
+		}
+		seen[c] = struct{}{}
+		out = append(out, c)
+	}
+	return out
+}
+
+func prepareOCIDirectory(ctx context.Context, pullCache *memorypullcache.MemoryPullCache, actorTemplateNamespace, actorTemplateName, actorID, containerName, ref string, args []string, env []string, capAdds []string, runAsUser, runAsGroup int64, annotations map[string]string, netns string) error {
 	tracer := otel.Tracer("prepareOCIDirectory")
 
 	ctx, span := tracer.Start(ctx, "prepareOCIDirectory")
@@ -69,35 +111,22 @@ func prepareOCIDirectory(ctx context.Context, pullCache *memorypullcache.MemoryP
 	ociSpec := &specs.Spec{
 		Process: &specs.Process{
 			User: specs.User{
-				UID: 0,
-				GID: 0,
+				UID: uint32(runAsUser),
+				GID: uint32(runAsGroup),
 			},
 			Args: args,
 			Env:  envVars,
 			Cwd:  "/",
-			Capabilities: &specs.LinuxCapabilities{
-				Bounding: []string{
-					"CAP_AUDIT_WRITE",
-					"CAP_KILL",
-					"CAP_NET_BIND_SERVICE",
-				},
-				Effective: []string{
-					"CAP_AUDIT_WRITE",
-					"CAP_KILL",
-					"CAP_NET_BIND_SERVICE",
-				},
-				Inheritable: []string{
-					"CAP_AUDIT_WRITE",
-					"CAP_KILL",
-					"CAP_NET_BIND_SERVICE",
-				},
-				Permitted: []string{
-					"CAP_AUDIT_WRITE",
-					"CAP_KILL",
-					"CAP_NET_BIND_SERVICE",
-				},
-				// TODO(gvisor.dev/issue/3166): support ambient capabilities
-			},
+			Capabilities: func() *specs.LinuxCapabilities {
+				caps := resolveCapabilities(capAdds)
+				return &specs.LinuxCapabilities{
+					Bounding:    caps,
+					Effective:   caps,
+					Inheritable: caps,
+					Permitted:   caps,
+					// TODO(gvisor.dev/issue/3166): support ambient capabilities
+				}
+			}(),
 			Rlimits: []specs.POSIXRlimit{
 				{
 					Type: "RLIMIT_NOFILE",

cmd/atelet/oci_test.go

@@ -0,0 +1,75 @@
+//  Copyright 2026 Google LLC
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+
+package main
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestResolveCapabilities(t *testing.T) {
+	defaults := []string{"CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE"}
+
+	cases := []struct {
+		name string
+		adds []string
+		want []string
+	}{
+		{
+			name: "nil adds yields defaults only",
+			adds: nil,
+			want: defaults,
+		},
+		{
+			name: "empty adds yields defaults only",
+			adds: []string{},
+			want: defaults,
+		},
+		{
+			name: "prefix-less names normalised and appended",
+			adds: []string{"NET_ADMIN", "SETUID", "SETGID"},
+			want: append(append([]string{}, defaults...), "CAP_NET_ADMIN", "CAP_SETUID", "CAP_SETGID"),
+		},
+		{
+			name: "already-prefixed names accepted verbatim",
+			adds: []string{"CAP_NET_ADMIN"},
+			want: append(append([]string{}, defaults...), "CAP_NET_ADMIN"),
+		},
+		{
+			name: "lowercase normalised to uppercase",
+			adds: []string{"cap_net_admin", "setuid"},
+			want: append(append([]string{}, defaults...), "CAP_NET_ADMIN", "CAP_SETUID"),
+		},
+		{
+			name: "duplicates across defaults and adds collapse",
+			adds: []string{"CAP_KILL", "NET_ADMIN", "CAP_NET_ADMIN"},
+			want: append(append([]string{}, defaults...), "CAP_NET_ADMIN"),
+		},
+		{
+			name: "blank entries ignored",
+			adds: []string{"", "  ", "NET_ADMIN"},
+			want: append(append([]string{}, defaults...), "CAP_NET_ADMIN"),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := resolveCapabilities(tc.adds)
+			if !reflect.DeepEqual(got, tc.want) {
+				t.Fatalf("resolveCapabilities(%v) = %v, want %v", tc.adds, got, tc.want)
+			}
+		})
+	}
+}