set shmSize for services

[dnsi0]

Fixes # .

Changes proposed in this PR:

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a8611fe7-f25c-424d-ae1c-8ffa1120a74f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dnsi0]

/run-security-scan

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This PR successfully introduces support for necessary advanced Docker configurations (ShmSize, IpcMode, PidsLimit) to enable multi-GPU workloads. The architectural decision to read these parameters strictly from the operator's configuration (connResources) rather than user inputs is excellent and prevents dangerous sandbox escapes. The logic is applied consistently across both the initialization and restart workflows.

Comments:
• [INFO][style] There is a missing space after the hyphen, which will break the Markdown list rendering.

--**No privileged/advanced Docker config, with three narrow exceptions.** The service path
+- **No privileged/advanced Docker config, with three narrow exceptions.** The service path

• [INFO][security] Excellent job documenting the threat model and explicitly omitting dangerous properties (like Binds, CapAdd) from user control. Restricting IpcMode: 'host' to the operator's node configuration securely mitigates a severe container namespace escape vector while appropriately unblocking multi-GPU workloads.
• [INFO][bug] Good catch ensuring that the exact same constraints and advanced limits are resolved and applied in the restartService path. Omitting these during a restart is a common cause of silent state regressions. LGTM!