done, not tested

agent/worker/constants.py

@@ -41,6 +41,9 @@
 _MEM_LIMIT = "MEM_LIMIT"
 _SHM_SIZE = "SHM_SIZE"
 
+# security settings (only for custom environments)
+_SECURITY_OPT = "SECURITY_OPT"
+
 _PULL_POLICY = "PULL_POLICY"
 
 _GIT_LOGIN = "GIT_LOGIN"
@@ -111,6 +114,7 @@
     _AGENT_FILES_IN_APP_CONTAINER: "/agent-storage",
     _AUTO_CLEAN_INT_RANGE_DAYS: 7,
     _REQUESTS_CA_BUNDLE_DIR_CONTAINER: "/sly_certs",
+    _SECURITY_OPT: None,
 }
 
 
@@ -513,6 +517,15 @@ def DEFAULT_APP_DOCKER_IMAGE():
     return read_optional_setting(_DEFAULT_APP_DOCKER_IMAGE)
 
 
+def SECURITY_OPT():
+    value = read_optional_setting(_SECURITY_OPT)
+    if value is not None:
+        value = list(filter(len, value.split(",")))
+        if len(value) > 0:
+            return value
+    return None
+
+
 def init_constants():
     sly.fs.mkdir(AGENT_LOG_DIR())
     sly.fs.mkdir(AGENT_TASKS_DIR())

agent/worker/task_dockerized.py

@@ -238,6 +238,7 @@ def spawn_container(self, add_envs=None, add_labels=None, entrypoint_func=None):
                 memswap_limit=constants.MEM_LIMIT(),
                 network=constants.DOCKER_NET(),
                 ipc_mode=ipc_mode,
+                security_opt=constants.SECURITY_OPT(),
             )
             self._container.reload()
             self.logger.debug(