Sync common files from infra repository (#28)

Synchronized from bootc-dev/infra@1c2a5bc.

Signed-off-by: bootc-dev Bot <bot@bootc.dev>
Co-authored-by: bootc-dev Bot <bot@bootc.dev>

Author: bootc-bot[bot]

.bootc-dev-infra-commit.txt

@@ -1 +1 @@
-e15b9622fcef58276464960124823108858dc646
+1c2a5bc48c08d077982cbae3bb9cd03e2923683a

.devcontainer/devcontainer.json

@@ -13,13 +13,16 @@
   },
   "features": {},
   "runArgs": [
-    // Minimal security options for nested podman (avoids --privileged):
-    // - label=disable: Required for mounting /proc in nested user namespace
-    // - unmask=/proc/*: Allows access to /proc paths needed for nested containers
+    // In general we hope that the outer environment has set up
+    // a user namespace to keep this secure.
+    "--cap-add=all",
+    // Required for mounting /proc in nested user namespace
     "--security-opt", "label=disable",
+    // Allows access to /proc paths needed for nested containers
     "--security-opt", "unmask=/proc/*",
     // Device access for nested containers and VMs
     "--device", "/dev/net/tun",
+    // I always want KVM
     "--device", "/dev/kvm"
   ],
   "postCreateCommand": {