Add capabilities at build

sloptrap-entrypoint

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+helper_pid=""
+
+cleanup() {
+  if [[ -n $helper_pid ]]; then
+    kill "$helper_pid" >/dev/null 2>&1 || true
+    wait "$helper_pid" >/dev/null 2>&1 || true
+  fi
+}
+
+trap cleanup EXIT INT TERM HUP
+
+if [[ $# -eq 0 ]]; then
+  set -- codex
+fi
+
+if [[ $(id -u) -eq 0 ]]; then
+  helper_dir=${SLOPTRAP_HELPER_DIR:-/run/sloptrap-helper}
+  mkdir -p "$helper_dir/queue"
+  chmod 700 "$helper_dir"
+  if [[ -n ${SLOPTRAP_ACTIVE_CAPABILITIES:-} ]]; then
+    /usr/local/bin/sloptrap-helperd &
+    helper_pid=$!
+  fi
+  exec runuser -u sloptrap --preserve-environment -- "$@"
+fi
+
+exec "$@"