features: add unsafeAnnotationPrefixes

Fix issue 1202

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

features.md

@@ -138,6 +138,18 @@ Annotations MUST be a key-value map that follows the same convention as the Key
 }
 ```
 
+## <a name="featuresUnsafeAnnotationPrefixes" />Unsafe annotation prefixes
+
+**`unsafeAnnotationPrefixes`** (array of strings, OPTIONAL) contains prefixes of the [`annotations` property of `config.json`](config.md#annotations)
+that may change the behavior of the runtime.
+
+### Example
+```json
+"unsafeAnnotationPrefixes": [
+  "org.systemd.property."
+]
+```
+
 # Example
 
 Here is a full example for reference.

schema/features-schema.json

@@ -17,6 +17,9 @@
         },
         "annotations": {
             "$ref": "defs.json#/definitions/annotations"
+        },
+        "unsafeAnnotationPrefixes": {
+            "$ref": "defs.json#/definitions/ArrayOfStrings"
         },
          "linux": {
             "$ref": "features-linux.json#/linux"

specs-go/features/features.go

@@ -24,6 +24,10 @@ type Features struct {
 	// Annotations contains implementation-specific annotation strings,
 	// such as the implementation version, and third-party extensions.
 	Annotations map[string]string `json:"annotations,omitempty"`
+
+	// UnsafeAnnotationPrefixes is the list of the unsafe prefixes of the annotations
+	// that may appear in `config.json`.
+	UnsafeAnnotationPrefixes []string `json:"unsafeAnnotationPrefixes,omitempty"`
 }
 
 // Linux is specific to Linux.