feat(schema): add LocalVerifier.RunArgs for docker run passthrough

Adds an optional `runArgs []string` field to the `local` executionMode
of customActions. The field is intended for docker run-style flags
(`--network`, `-v`, `-e`, `--user`, `--add-host`, `--tmpfs`,
`--privileged`, `--cap-add`, `--cap-drop`) that let users pass host
paths, credentials, or networking configuration into action containers
without forking Skaffold.

The field itself is schema-only here; the whitelist parser and splicing
into the docker API client arrive in a follow-up commit. A security
note in the godoc warns that these flags bypass container isolation.

Regenerates the v4beta15 JSON schema.

Author: bogdannazarenko

docs-v2/content/en/schemas/v4beta15.json

@@ -3442,6 +3442,15 @@
     },
     "LocalVerifier": {
       "properties": {
+        "runArgs": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "description": "an optional list of `docker run` style flags to apply when launching the container, e.g. `--network=host`, `-v=/host:/container:ro`, `-e=FOO=bar`, `--user=1000:1000`. Only a small whitelist of flags is accepted (`--network`, `-v`/`--volume`, `-e`/`--env`, `--user`, `--add-host`, `--tmpfs`, `--privileged`, `--cap-add`, `--cap-drop`); unknown flags are rejected at load time.  SECURITY NOTE: these flags bypass container isolation. `--privileged`, bind mounts of host secrets, and `--network=host` grant the container access to host resources. Only use values you trust, and prefer narrower alternatives (e.g. `--cap-add` over `--privileged`) when possible.",
+          "x-intellij-html-description": "an optional list of <code>docker run</code> style flags to apply when launching the container, e.g. <code>--network=host</code>, <code>-v=/host:/container:ro</code>, <code>-e=FOO=bar</code>, <code>--user=1000:1000</code>. Only a small whitelist of flags is accepted (<code>--network</code>, <code>-v</code>/<code>--volume</code>, <code>-e</code>/<code>--env</code>, <code>--user</code>, <code>--add-host</code>, <code>--tmpfs</code>, <code>--privileged</code>, <code>--cap-add</code>, <code>--cap-drop</code>); unknown flags are rejected at load time.  SECURITY NOTE: these flags bypass container isolation. <code>--privileged</code>, bind mounts of host secrets, and <code>--network=host</code> grant the container access to host resources. Only use values you trust, and prefer narrower alternatives (e.g. <code>--cap-add</code> over <code>--privileged</code>) when possible.",
+          "default": "[]"
+        },
         "useLocalImages": {
           "type": "boolean",
           "description": "if true, will first check if the containers images exist locally before triggering a pull. Defaults to false.",
@@ -3450,7 +3459,8 @@
         }
       },
       "preferredOrder": [
-        "useLocalImages"
+        "useLocalImages",
+        "runArgs"
       ],
       "additionalProperties": false,
       "type": "object",

pkg/skaffold/schema/latest/config.go

@@ -684,6 +684,20 @@ type LocalVerifier struct {
 	// UseLocalImages if true, will first check if the containers images exist locally before triggering a pull.
 	// Defaults to false.
 	UseLocalImages bool `yaml:"useLocalImages,omitempty"`
+
+	// RunArgs is an optional list of `docker run` style flags to apply when
+	// launching the container, e.g. `--network=host`, `-v=/host:/container:ro`,
+	// `-e=FOO=bar`, `--user=1000:1000`. Only a small whitelist of flags is
+	// accepted (`--network`, `-v`/`--volume`, `-e`/`--env`, `--user`,
+	// `--add-host`, `--tmpfs`, `--privileged`, `--cap-add`, `--cap-drop`);
+	// unknown flags are rejected at load time.
+	//
+	// SECURITY NOTE: these flags bypass container isolation. `--privileged`,
+	// bind mounts of host secrets, and `--network=host` grant the container
+	// access to host resources. Only use values you trust, and prefer
+	// narrower alternatives (e.g. `--cap-add` over `--privileged`) when
+	// possible.
+	RunArgs []string `yaml:"runArgs,omitempty"`
 }
 
 // KubernetesClusterVerifier uses the `kubectl` CLI to create veriy test case