doing it

.devcontainer/devcontainer.json

@@ -0,0 +1,25 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/go
+{
+	"name": "Go",
+	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+	"image": "mcr.microsoft.com/devcontainers/go:1-1.21-bullseye",
+	"features": {
+		"ghcr.io/devcontainers/features/docker-in-docker:2": {}
+	}
+
+	// Features to add to the dev container. More info: https://containers.dev/features.
+	// "features": {},
+
+	// Use 'forwardPorts' to make a list of ports inside the container available locally.
+	// "forwardPorts": [],
+
+	// Use 'postCreateCommand' to run commands after the container is created.
+	// "postCreateCommand": "go version",
+
+	// Configure tool-specific properties.
+	// "customizations": {},
+
+	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
+	// "remoteUser": "root"
+}

driver/docker-container/driver.go

@@ -140,7 +140,7 @@ func (d *Driver) create(ctx context.Context, l progress.SubLogger) error {
 				return err
 			}
 			for _, f := range secOpts {
-				fmt.Println(f)
+				fmt.Println("range of opts ", f)
 				if f.Name == "userns" {
 					hc.UsernsMode = "host"
 					break
@@ -149,13 +149,17 @@ func (d *Driver) create(ctx context.Context, l progress.SubLogger) error {
 			//hc.SecurityOpt=["seccomp:unconfined" "apparmor:unconfined" "systempaths:unconfined"]
 			hc.SecurityOpt = append(hc.SecurityOpt, "seccomp=unconfined")
 			hc.SecurityOpt = append(hc.SecurityOpt, "apparmor=unconfined")
-			hc.SecurityOpt = append(hc.SecurityOpt, "systempaths=unconfined")
+			//hc.SecurityOpt = append(hc.SecurityOpt, "systempaths=unconfined")
 			hc.Privileged = false
 		}
-		fmt.Println(cfg)
-		fmt.Println(hc)
+		fmt.Println("cfg: ", cfg)
+		fmt.Println("hc privileged:", hc.Privileged)
+		fmt.Println("hc: ", hc.SecurityOpt)
+		fmt.Println("hc: ", hc.SecurityOpt)
+		fmt.Println(hc.SecurityOpt)
 		_, err := d.DockerAPI.ContainerCreate(ctx, cfg, hc, &network.NetworkingConfig{}, nil, d.Name)
 		if err != nil && !errdefs.IsConflict(err) {
+			l.Wrap("fucking dumb", func() error { fmt.Println(err.Error()); return nil })
 			return err
 		}
 		if err == nil {