feat: add support for cap_add and cap_drop compose keys (#238)

pkg/api/service.go

@@ -225,6 +225,10 @@ func (s *ServiceSpec) Clone() ServiceSpec {
 // ContainerSpec defines the desired state of a container in a service.
 // ATTENTION: after changing this struct, verify if deploy.EvalContainerSpecChange needs to be updated.
 type ContainerSpec struct {
+	// Specifies which additional capabilities should be added for the container.
+	CapAdd []string
+	// Specifies which capabilities should be dropped from the container.
+	CapDrop []string
 	// Command overrides the default CMD of the image to be executed when running a container.
 	Command []string
 	// Entrypoint overrides the default ENTRYPOINT of the image.
@@ -343,6 +347,14 @@ func (s *ContainerSpec) Clone() ContainerSpec {
 			spec.ConfigMounts[i] = cm.Clone()
 		}
 	}
+	if s.CapAdd != nil {
+		spec.CapAdd = make([]string, len(s.CapAdd))
+		copy(spec.CapAdd, s.CapAdd)
+	}
+	if s.CapDrop != nil {
+		spec.CapDrop = make([]string, len(s.CapDrop))
+		copy(spec.CapDrop, s.CapDrop)
+	}
 
 	return spec
 }

pkg/api/service_test.go

@@ -209,6 +209,8 @@ func TestServiceSpec_Validate_CaddyAndPorts(t *testing.T) {
 func TestContainerSpec_Clone(t *testing.T) {
 	mode := os.FileMode(0o644)
 	original := ContainerSpec{
+		CapAdd:     []string{"NET_ADMIN"},
+		CapDrop:    []string{"ALL"},
 		Command:    []string{"sh", "-c", "echo hello"},
 		Entrypoint: []string{"/bin/bash"},
 		Env: EnvVars{
@@ -247,6 +249,8 @@ func TestContainerSpec_Clone(t *testing.T) {
 
 	// Verify deep copy by modifying the original
 	stringModified := "modified"
+	original.CapAdd[0] = stringModified
+	original.CapDrop[0] = stringModified
 	original.Command[0] = stringModified
 	original.Entrypoint[0] = stringModified
 	original.Env["FOO"] = stringModified
@@ -258,6 +262,8 @@ func TestContainerSpec_Clone(t *testing.T) {
 
 	assert.False(t, original.Equals(cloned))
 	// Assert cloned values are unchanged
+	assert.Equal(t, "NET_ADMIN", cloned.CapAdd[0])
+	assert.Equal(t, "ALL", cloned.CapDrop[0])
 	assert.Equal(t, "sh", cloned.Command[0])
 	assert.Equal(t, "/bin/bash", cloned.Entrypoint[0])
 	assert.Equal(t, "bar", cloned.Env["FOO"])