feat(core): allow user to provide docker --security-opt when bundling (…

…#14682)

Allows user to pass `securityOpts` to [DockerRunOptions](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_core.DockerRunOptions.html) so that docker [security configurations](https://docs.docker.com/engine/reference/run/#security-configuration) can be set for developers working in restrictive dev environments.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

packages/@aws-cdk/core/lib/bundling.ts

@@ -186,6 +186,9 @@ export class BundlingDockerImage {
 
     const dockerArgs: string[] = [
       'run', '--rm',
+      ...options.securityOpt
+        ? ['--security-opt', options.securityOpt]
+        : [],
       ...options.user
         ? ['-u', options.user]
         : [],
@@ -405,6 +408,14 @@ export interface DockerRunOptions {
    * @default - root or image default
    */
   readonly user?: string;
+
+  /**
+   * [Security configuration](https://docs.docker.com/engine/reference/run/#security-configuration)
+   * when running the docker container.
+   *
+   * @default - no secutiy options
+   */
+  readonly securityOpt?: string;
 }
 
 /**

packages/@aws-cdk/core/test/bundling.test.ts

@@ -342,4 +342,41 @@ nodeunitShim({
 
     test.done();
   },
+
+  'adding user provided securit-opt'(test: Test) {
+    const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
+      status: 0,
+      stderr: Buffer.from('stderr'),
+      stdout: Buffer.from('stdout'),
+      pid: 123,
+      output: ['stdout', 'stderr'],
+      signal: null,
+    });
+
+    const image = DockerImage.fromRegistry('alpine');
+    image.run({
+      command: ['cool', 'command'],
+      environment: {
+        VAR1: 'value1',
+        VAR2: 'value2',
+      },
+      securityOpt: 'no-new-privileges',
+      volumes: [{ hostPath: '/host-path', containerPath: '/container-path' }],
+      workingDirectory: '/working-directory',
+      user: 'user:group',
+    });
+
+    test.ok(spawnSyncStub.calledWith('docker', [
+      'run', '--rm',
+      '--security-opt', 'no-new-privileges',
+      '-u', 'user:group',
+      '-v', '/host-path:/container-path:delegated',
+      '--env', 'VAR1=value1',
+      '--env', 'VAR2=value2',
+      '-w', '/working-directory',
+      'alpine',
+      'cool', 'command',
+    ], { stdio: ['ignore', process.stderr, 'inherit'] }));
+    test.done();
+  },
 });