disable for self-hosters

Author: carderne

apps/supervisor/src/index.ts

@@ -120,6 +120,7 @@ class ManagedSupervisor {
       snapshotPollIntervalSeconds: env.RUNNER_SNAPSHOT_POLL_INTERVAL_SECONDS,
       additionalEnvVars: env.RUNNER_ADDITIONAL_ENV_VARS,
       dockerAutoremove: env.DOCKER_AUTOREMOVE_EXITED_CONTAINERS,
+      checkpointsEnabled: !!env.TRIGGER_CHECKPOINT_URL,
     } satisfies WorkloadManagerOptions;
 
     this.resourceMonitor = env.RESOURCE_MONITOR_ENABLED

apps/supervisor/src/workloadManager/kubernetes.ts

@@ -110,9 +110,13 @@ export class KubernetesWorkloadManager implements WorkloadManager {
 
     try {
       const basePodSpec = this.addPlacementTags(this.#defaultPodSpec, opts.placementTags);
-      const podSpec = runtimeRequiresSeccompProfile(opts.runtime)
-        ? withBlockIoUringSeccompProfile(basePodSpec)
-        : basePodSpec;
+      // The io_uring-blocking profile is only needed to keep pods checkpointable.
+      // Skip it unless checkpointing is enabled - self-hosters don't have the
+      // profile provisioned on their nodes, so applying it would fail pod creation.
+      const podSpec =
+        this.opts.checkpointsEnabled && runtimeRequiresSeccompProfile(opts.runtime)
+          ? withBlockIoUringSeccompProfile(basePodSpec)
+          : basePodSpec;
 
       await this.k8s.core.createNamespacedPod({
         namespace: this.namespace,

apps/supervisor/src/workloadManager/types.ts

@@ -16,6 +16,11 @@ export interface WorkloadManagerOptions {
   snapshotPollIntervalSeconds?: number;
   additionalEnvVars?: Record<string, string>;
   dockerAutoremove?: boolean;
+  // Whether CRIU checkpoint/restore is enabled for this deployment. Only when
+  // checkpointing is enabled do node-24+ pods need the io_uring-blocking seccomp
+  // profile (io_uring FDs can't be checkpointed). Self-hosters without
+  // checkpointing don't need it - and don't have the profile on their nodes.
+  checkpointsEnabled?: boolean;
 }
 
 export interface WorkloadManager {