Following the instructions from this PR it's possible to run workspace Pod using a specific SCC.

That works fine until the workspace service account doesn't have any other SCC with same/higher priority.

Adding an SCC to workspaces SA is not enough, we need to explicitly list the required capabilities in the workspace Pod spec. I am not sure what's the best approach:

1. automatically extracting the capabilities from the SCC
2. requesting users to specify the capabilities in the DevWorkspace (with the new spec.pods?)