fix(3293) Ambient capabilities are not applied as expected

[tommady]

Description

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Performance improvement
• Test updates
• CI/CD related changes
• Other (please describe):

Testing

• Added new unit tests
• Added new integration tests
• Ran existing test suite
• Tested manually (please provide steps)

Related Issues

Fixes #3293

Additional Context

follow the Steps to Reproduce and Expectation from the issue

[tommady]

hi @saku3
please help review while you have time.
thanks.

[Copilot]

Pull Request Overview

This PR fixes an issue where ambient capabilities were not being applied correctly to containers. The fix changes the error handling approach from silently logging warnings to properly raising ambient capabilities and propagating errors.

Key Changes:

• Added explicit handling for CapSet::Ambient in the syscall layer to raise each capability individually
• Changed ambient capability setting to propagate errors instead of silently failing with warnings

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
crates/libcontainer/src/syscall/linux.rs	Added new match arm for CapSet::Ambient to raise capabilities individually with error logging
crates/libcontainer/src/capabilities.rs	Removed silent error handling for ambient capabilities, now propagates errors via ? operator

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[saku3]

Thanks!

It looks good for me.

for i in {1..100}; do youki run -b tutorial/ a; done

I ran the above command locally and confirmed that the result is consistent.
(However, I’m not sure how we should write a test for this...)

[saku3]

@utam0k @YJDoc2
PTAL

[utam0k]

May I ask you to add the e2e test(contest)?

[tommady]

May I ask you to add the e2e test(contest)?

Hi @utam0k,
there will be an e2e test in this PR
#3210
which is the reason why @saku3 found this issue

is that ok with you?

[saku3]

As tommady commented, once this PR(#3210) is merged, there shouldn’t be any regressions related to this issue.

[utam0k]

LGTM