[ricardobranco777]

The child was started with CLONE_NEWUSER before its uid_map was written, so the exec dropped all the caps, and the child re-executed itself after the maps were written to gain them. With no_new_privs set, the re-exec cannot gain caps, so the child ended up waiting forever for a message from the parent.

Start the child with all the caps as ambient caps, so it keeps them across the exec and does not need to re-execute. The re-execution is kept as a fallback. The child now always does the handshake with the parent once, and clears the inheritable and ambient caps afterwards so they are not inherited by the workload.

Fixes #551

[ricardobranco777]

Steps to test on openSUSE Tumbleweed 20261018:

zypper in enable-no_new_privs
systemctl enable --now polkit-agent-helper.socket
reboot

rootlesskit true now works and I can run rootless Docker.

[Copilot]

🟡 Changes recommended

Unconditional ambient-capability operations prevent startup on kernels without that support, bypassing the retained fallback.

1 open issue

• Avoid setting ambient capabilities on unsupported kernels · New

What changed in this PR

This PR addresses the startup hang under no_new_privs described in #551 by preserving the child’s capabilities across execution.

Changes:

• Pass ambient capabilities to the child while retaining the re-execution fallback.
• Perform the parent-child handshake once and clear inheritable and ambient capabilities before starting the workload.
• Add regression coverage for both PID namespace modes and run it in CI.

File	Description
pkg/​parent/​parent.go	Populate the child’s ambient capabilities from kernel-supported capabilities.
pkg/​child/​child.go	Update handshake and re-execution handling; clear inherited capabilities.
hack/​integration-no-new-privs.sh	Test startup under no_new_privs with and without a PID namespace.
.github/​workflows/​main.yaml	Run the new integration test in CI.

_{Review effort: Balanced}