cli/command/container: add create/run --umask

[zhangyoufu]

• fixes Add option to docker run to set umask in container moby/moby#19189

moby/moby#19189 requested this feature in 2016. (labeled milestone 29.8.0 at the time of writing)
opencontainers/runtime-spec#941 added Spec.Process.User.Umask in 2019.
containers/crun#217 added umask support in 2019.
opencontainers/runc#2527 added umask support in 2020.
opencontainers/runc#3661 added umask support for exec in 2023.

- What I did

I added HostConfig.Umask field in moby/moby#53463.
This PR implements the CLI part, docker create/run --umask <octal>.
Blocked by #7281 vendoring moby api changes.

- How I did it

• add type UmaskOpt in opts (parsing octal input)
• add cli/command/container.containerOptions.umask field and flag, wiring to HostConfig.Umask
• write tests

- How to verify it

docker run --rm --umask 1 alpine sh -c umask

- Human readable description for the release notes

Add `--umask <octal>` flag in `docker create`/`docker run` to set the umask for a container's entrypoint, exec, and healthcheck.

[thaJeztah]

oh! validation will fail because it needs #7259 (or updated version of that)

cc @vvoland

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[thaJeztah]

@zhangyoufu the other PR was merged, so you can drop the first commit. Also may need to make mddocs to regenerate the markdown.

[thaJeztah]

LGTM, thx!

[zhangyoufu]

Still trying to figure out the e2e test error
"--umask" requires API version 1.56, but the Docker daemon API version is 1.44

[vvoland]

Yeah the e2e tests run against the current stable. We need a skip for older API versions

[zhangyoufu]

and this one, the umask is not effective

=== Failed
=== FAIL: e2e/container TestRunUmask/zero (0.26s)
    run_test.go:133: assertion failed: 
        --- ←
        +++ tc.expected
        @@ -1,2 +1,2 @@
        -0022
        +0000
         
        

=== FAIL: e2e/container TestRunUmask/octal-777 (0.25s)
    run_test.go:133: assertion failed: 
        --- ←
        +++ tc.expected
        @@ -1,2 +1,2 @@
        -0022
        +0777

Is it due to the engine version being 29.8.0-rc.1?
Need a bump for docker.io/library/cliendtoendsuite-engine image I think.

[vvoland]

Yes, that change wasn't in the RC yet.
For now let's just add the skip for API < 1.56.

[thaJeztah]

I think it's fine to add a t.Skip("FIXME: un-skip once e2e tests v29.8.0")

We can replace that with a version-based skip later (feature is already tested in the moby repository at API level)

[vvoland]

Pushed commit with skip

[thaJeztah]

LGTM