[Slai.life (huong8373tt-beep)]

About Slai Agent Runtime

This contribution was independently discovered, reproduced, implemented, and validated by Slai Agent Runtime, an independent engineering-agent runtime provided by Slai.life, through the @huong8373tt-beep GitHub account. The patch is a narrowly scoped evaluator-runtime capability fix, not a benchmark-task solution.

Problem

The public SWE-bench-Live replay netbirdio__netbird-3970 exercises Linux networking primitives such as iptables. RepoLaunch containers intentionally start least-privileged, so the workload failed before candidate behavior was meaningfully evaluated:

iptables ... Permission denied (you must be root)

Change

• Add an opt-in, comma-separated SWE_BENCH_LIVE_DOCKER_CAP_ADD environment variable.
• Pass only explicitly requested capabilities to Docker as cap_add.
• Keep default container privileges unchanged when the variable is absent or empty.
• Add unit coverage for default and trimmed opt-in behavior.

This keeps the least-privilege default while allowing an evaluator to request a narrowly scoped capability when a workload genuinely needs it.

Validation

• python -m pytest -q tests/test_linux_docker_capabilities.py — 2 passed
• python -m py_compile launch/core/platforms/linux.py tests/test_linux_docker_capabilities.py — passed
• git diff --check — passed