feat: default container sandbox to drop all capabilities and fix error assignment in container data write.

pkg/agent/sandbox/container.go

@@ -653,7 +653,7 @@ func (f *containerFS) WriteFile(ctx context.Context, p string, data []byte, mkdi
 	defer attach.Close()
 
 	// Write data to the hijacked connection's stdin
-	if _, err := attach.Conn.Write(data); err != nil {
+	if _, err = attach.Conn.Write(data); err != nil {
 		return fmt.Errorf("failed to write data to container: %w", err)
 	}
 

pkg/config/defaults.go

@@ -43,6 +43,7 @@ func DefaultConfig() *Config {
 						ApparmorProfile: "",
 						DNS:             []string{},
 						ExtraHosts:      []string{},
+						CapDrop:         []string{"ALL"},
 						Binds:           []string{},
 					},
 					Prune: AgentSandboxPruneConfig{