feat: add capabilities parameter to ServiceConfig

[swapnilraj]

Summary

• Add capabilities parameter to ServiceConfig in Starlark, allowing users to specify Linux container capabilities (e.g., NET_ADMIN, SYS_PTRACE)
• Wire capabilities through both Docker backend (via WithAddedCapabilities) and Kubernetes backend (via SecurityContext.Capabilities)
• Include unit tests for field storage, JSON marshalling, and Starlark parsing

This is a revival of the previously closed #2457, with a complete implementation that covers both Docker and Kubernetes backends, uses the setter pattern (non-breaking, no changes to CreateServiceConfig signature), and includes full test coverage.

Motivation

We are building chaoswopr, an AI-driven chaos engineering tool for Ethereum operational resilience testing. It uses Kurtosis to deploy private Ethereum testnets and inject faults at the network level using tools like tc and netem. These tools require the NET_ADMIN capability, which is not currently exposed through Kurtosis's ServiceConfig.

Usage

plan.add_service(
    name = "test-net-admin",
    config = ServiceConfig(
        image = "alpine:latest",
        capabilities = ["NET_ADMIN"],
    ),
)

After which:

kurtosis service exec <enclave> test-net-admin "tc qdisc add dev eth0 root netem loss 20%"
# Succeeds without "Operation not permitted"

Changes

File	Change
service_config.go (objects/service)	Add Capabilities []string field, getter, and setter
service_config.go (kurtosis_types)	Add capabilities Starlark parameter, extract and set on ServiceConfig
start_user_services.go (docker)	Extract capabilities, convert to ContainerCapability map, pass to builder
start_user_services.go (kubernetes)	Extract capabilities, add to SecurityContext.Capabilities.Add
service_config_test.go	Unit tests for field access and JSON marshalling
service_config_capabilities_test.go	Starlark framework test for parsing capabilities

Is this change user facing?

YES

Test plan

• Unit tests for ServiceConfig.GetCapabilities() / SetCapabilities()
• JSON marshal/unmarshal round-trip test for capabilities
• Starlark framework test parsing capabilities = ["NET_ADMIN", "SYS_PTRACE"]
• All existing tests pass (service config, add_service, Starlark framework)
• go build succeeds for core/server and container-engine-lib modules

Generated with Claude Code