feat(supervisor): make the runner seccomp profile path configurable

Author: nicktrn

apps/supervisor/src/env.ts

@@ -210,6 +210,7 @@ export const Env = z
 
     KUBERNETES_MEMORY_OVERHEAD_GB: z.coerce.number().min(0).optional(), // Optional memory overhead to add to the limit in GB
     KUBERNETES_SCHEDULER_NAME: z.string().optional(), // Custom scheduler name for pods
+    KUBERNETES_RUNNER_SECCOMP_PROFILE_PATH: z.string().default("profiles/block-io-uring.json"),
 
     // Pod DNS config — override the cluster default ndots to `KUBERNETES_POD_DNS_NDOTS`.
     // Default k8s ndots is 5: any name with fewer than 5 dots (e.g. `api.example.com`, 2 dots) is first walked

apps/supervisor/src/workloadManager/kubernetes.test.ts

@@ -1,9 +1,8 @@
 import { describe, expect, it } from "vitest";
 import {
-  BLOCK_IO_URING_SECCOMP_PROFILE,
   nodetypeNodeSelector,
   runPodTolerations,
-  withBlockIoUringSeccompProfile,
+  withRunnerSeccompProfile,
   withNodeSelector,
 } from "./kubernetesPodSpec.js";
 
@@ -100,27 +99,25 @@ describe("withNodeSelector", () => {
   });
 });
 
-describe("withBlockIoUringSeccompProfile", () => {
-  it("adds the Localhost io_uring profile for node-24 and above, preserving pod security defaults", () => {
-    for (const runtime of ["node-24", "node-26", "node-30", "experimental-node-24"]) {
-      const podSpec = withBlockIoUringSeccompProfile(basePodSpec, runtime);
-
-      expect(podSpec).toMatchObject({
-        ...basePodSpec,
-        securityContext: {
-          ...basePodSpec.securityContext,
-          seccompProfile: {
-            type: "Localhost",
-            localhostProfile: BLOCK_IO_URING_SECCOMP_PROFILE,
-          },
+describe("withRunnerSeccompProfile", () => {
+  it("applies the profile for every runtime, preserving pod security defaults", () => {
+    const podSpec = withRunnerSeccompProfile(basePodSpec, "profiles/example.json");
+
+    expect(podSpec).toMatchObject({
+      ...basePodSpec,
+      securityContext: {
+        ...basePodSpec.securityContext,
+        seccompProfile: {
+          type: "Localhost",
+          localhostProfile: "profiles/example.json",
         },
-      });
-    }
+      },
+    });
   });
 
-  it("leaves the pod spec unchanged for runtimes that do not create io_uring fds", () => {
-    for (const runtime of ["node", "node-22", "bun", undefined, null, ""]) {
-      expect(withBlockIoUringSeccompProfile(basePodSpec, runtime)).toEqual(basePodSpec);
+  it("leaves the pod spec untouched when no profile is configured", () => {
+    for (const profilePath of [undefined, ""]) {
+      expect(withRunnerSeccompProfile(basePodSpec, profilePath)).toBe(basePodSpec);
     }
   });
 });

apps/supervisor/src/workloadManager/kubernetes.ts

@@ -17,7 +17,7 @@ import { getRunnerId } from "../util.js";
 import {
   nodetypeNodeSelector,
   runPodTolerations,
-  withBlockIoUringSeccompProfile,
+  withRunnerSeccompProfile,
   withNodeSelector,
 } from "./kubernetesPodSpec.js";
 
@@ -136,7 +136,7 @@ export class KubernetesWorkloadManager implements WorkloadManager {
         }
       }
       const podSpec = this.opts.checkpointsEnabled
-        ? withBlockIoUringSeccompProfile(basePodSpec, opts.runtime)
+        ? withRunnerSeccompProfile(basePodSpec, env.KUBERNETES_RUNNER_SECCOMP_PROFILE_PATH)
         : basePodSpec;
 
       await this.k8s.core.createNamespacedPod({

apps/supervisor/src/workloadManager/kubernetesPodSpec.ts

@@ -1,11 +1,5 @@
 import type { k8s } from "../clients/kubernetes.js";
 
-/**
- * Relative path (kubelet seccomp root) of the profile blocking only io_uring
- * syscalls. Must match the profile deployed to worker nodes.
- */
-export const BLOCK_IO_URING_SECCOMP_PROFILE = "profiles/block-io-uring.json";
-
 /**
  * An empty label is the documented off-switch, leaving the pod unpinned. The Helm
  * chart ships an empty value, so don't collapse this into a fallback default -
@@ -61,16 +55,15 @@ export function withNodeSelector(
 }
 
 /**
- * Node >= 24 always creates io_uring fds, which can't be checkpointed. Blocking
- * io_uring_setup makes libuv fall back to epoll. Other runtimes don't need this,
- * so the profile is only applied for node-24+. Tolerates an "experimental-" prefix.
+ * Applies the runner seccomp profile. The profile is a node-local file installed
+ * outside this repo, so an empty path leaves the pod on the runtime default -
+ * pointing at a profile the nodes don't have fails pod creation.
  */
-export function withBlockIoUringSeccompProfile(
+export function withRunnerSeccompProfile(
   podSpec: Omit<k8s.V1PodSpec, "containers">,
-  runtime: string | null | undefined
+  profilePath: string | undefined
 ): Omit<k8s.V1PodSpec, "containers"> {
-  const match = runtime ? /^(?:experimental-)?node-(\d+)$/.exec(runtime) : null;
-  if (!match || Number(match[1]) < 24) {
+  if (!profilePath) {
     return podSpec;
   }
 
@@ -80,7 +73,7 @@ export function withBlockIoUringSeccompProfile(
       ...podSpec.securityContext,
       seccompProfile: {
         type: "Localhost",
-        localhostProfile: BLOCK_IO_URING_SECCOMP_PROFILE,
+        localhostProfile: profilePath,
       },
     },
   };