Enable FUSE in local-dev Docker containers

In ContainerClient::createContainer(), grant the minimum capabilities
needed so a FUSE mount inside the user's container succeeds:

- CapAdd: ["SYS_ADMIN"]         (for the mount() syscall)
- Devices: [/dev/fuse]            (so the kernel has something to open)
- SecurityOpt: ["apparmor:unconfined"] (bypasses the default docker
                                        apparmor profile's mount block)

No Privileged=true. Mirrors what Cloudflare's production container
runtime effectively provides for FUSE workers, without granting all
Linux capabilities or full /dev passthrough. Only affects workerd's
local Docker code path; production is unaffected.

Also adds missing $Json.name annotations to docker_api::DeviceMapping
fields in docker-api.capnp so they serialize as PathOnHost /
PathInContainer / CgroupPermissions to match the Docker API. This is
load-bearing for the Devices bind above — without it, the entry
serializes as camelCase and Docker silently ignores it. Before this PR
no call site populated Devices, so the missing annotations were latent.

Follows the existing pattern of createSidecarContainer() which already
sets CapAdd=[NET_ADMIN] for its own need at container-client.c++:1958.

End-to-end reproduction (libc mount("fuse", ...) syscall succeeding
inside the container, with a wire-level log confirming PathOnHost etc.
reach Docker correctly) at https://github.com/Ben2W/workerd-fuse-local-repro

Signed-off-by: Ben Werner <bewerner23@gmail.com>

Author: Ben2W

src/workerd/server/container-client.c++

@@ -1698,6 +1698,36 @@ kj::Promise<void> ContainerClient::createContainer(kj::StringPtr effectiveImage,
     }
   }
 
+  // Local-dev FUSE parity with production.
+  //
+  // Cloudflare's production container runtime exposes /dev/fuse to workers
+  // and grants the capabilities required to mount it. Locally we talk to a
+  // stock Docker daemon, which by default does not bind /dev/fuse into the
+  // container and does not grant CAP_SYS_ADMIN, so `open("/dev/fuse")` and
+  // the subsequent `mount("fuse", ...)` syscall fail with ENOENT / EPERM.
+  // Workers that use FUSE (e.g. the containers FUSE binding) therefore
+  // work in prod but break in local dev. Mirror what prod effectively
+  // provides with the narrowest capabilities needed: CAP_SYS_ADMIN so the
+  // mount() syscall can run, a /dev/fuse device binding so the kernel has
+  // something to open, and apparmor unconfined so the default Docker
+  // apparmor profile doesn't block the mount. This only affects local
+  // development via workerd's Docker client; production is unaffected.
+  {
+    auto capAdd = hostConfig.initCapAdd(1);
+    capAdd.set(0, "SYS_ADMIN");
+  }
+  {
+    auto devices = hostConfig.initDevices(1);
+    auto fuseDev = devices[0];
+    fuseDev.setPathOnHost("/dev/fuse");
+    fuseDev.setPathInContainer("/dev/fuse");
+    fuseDev.setCgroupPermissions("rwm");
+  }
+  {
+    auto securityOpt = hostConfig.initSecurityOpt(1);
+    securityOpt.set(0, "apparmor:unconfined");
+  }
+
   auto response = co_await dockerApiRequest(network, kj::str(dockerPath), kj::HttpMethod::POST,
       kj::str("/containers/create?name=", containerName), codec.encode(jsonRoot));
 

src/workerd/server/docker-api.capnp

@@ -32,9 +32,9 @@ struct Docker {
   }
 
   struct DeviceMapping {
-    pathOnHost @0 :Text;
-    pathInContainer @1 :Text;
-    cgroupPermissions @2 :Text;
+    pathOnHost @0 :Text $Json.name("PathOnHost");
+    pathInContainer @1 :Text $Json.name("PathInContainer");
+    cgroupPermissions @2 :Text $Json.name("CgroupPermissions");
   }
 
   struct DeviceRequest {