diff --git a/.bootc-dev-infra-commit.txt b/.bootc-dev-infra-commit.txt
index d241aec..a23c9fc 100644
--- a/.bootc-dev-infra-commit.txt
+++ b/.bootc-dev-infra-commit.txt
@@ -1 +1 @@
-e15b9622fcef58276464960124823108858dc646
+1c2a5bc48c08d077982cbae3bb9cd03e2923683a
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 3916c02..678171b 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -13,13 +13,16 @@
   },
   "features": {},
   "runArgs": [
-    // Minimal security options for nested podman (avoids --privileged):
-    // - label=disable: Required for mounting /proc in nested user namespace
-    // - unmask=/proc/*: Allows access to /proc paths needed for nested containers
+    // In general we hope that the outer environment has set up
+    // a user namespace to keep this secure.
+    "--cap-add=all",
+    // Required for mounting /proc in nested user namespace
     "--security-opt", "label=disable",
+    // Allows access to /proc paths needed for nested containers
     "--security-opt", "unmask=/proc/*",
     // Device access for nested containers and VMs
     "--device", "/dev/net/tun",
+    // I always want KVM
     "--device", "/dev/kvm"
   ],
   "postCreateCommand": {