refactor: use targeted io_uring seccomp profile instead of RuntimeDefault

Replace the RuntimeDefault seccomp profile on node-24+ run pods with a
Localhost profile that blocks only io_uring_setup/enter/register and allows
every other syscall. This keeps node-24+ pods CRIU-checkpointable (libuv
falls back to epoll) without RuntimeDefault's broad syscall allowlist, which
could break unrelated workloads (browsers, sandboxes, native threads). Still
scoped to node-24+; node/node-22/bun pods remain unconfined.

Author: carderne

apps/supervisor/src/workloadManager/kubernetes.test.ts

@@ -1,9 +1,31 @@
 import { describe, expect, it } from "vitest";
-import { withRuntimeDefaultSeccompProfile } from "./kubernetesPodSpec.js";
+import {
+  BLOCK_IO_URING_SECCOMP_PROFILE,
+  runtimeRequiresSeccompProfile,
+  withBlockIoUringSeccompProfile,
+} from "./kubernetesPodSpec.js";
 
-describe("withRuntimeDefaultSeccompProfile", () => {
-  it("adds RuntimeDefault seccomp while preserving pod security defaults", () => {
-    const podSpec = withRuntimeDefaultSeccompProfile({
+describe("runtimeRequiresSeccompProfile", () => {
+  it("returns true for node-24 and above", () => {
+    expect(runtimeRequiresSeccompProfile("node-24")).toBe(true);
+    expect(runtimeRequiresSeccompProfile("node-26")).toBe(true);
+    expect(runtimeRequiresSeccompProfile("node-30")).toBe(true);
+    expect(runtimeRequiresSeccompProfile("experimental-node-24")).toBe(true);
+  });
+
+  it("returns false for runtimes that do not create io_uring fds", () => {
+    expect(runtimeRequiresSeccompProfile("node")).toBe(false);
+    expect(runtimeRequiresSeccompProfile("node-22")).toBe(false);
+    expect(runtimeRequiresSeccompProfile("bun")).toBe(false);
+    expect(runtimeRequiresSeccompProfile(undefined)).toBe(false);
+    expect(runtimeRequiresSeccompProfile(null)).toBe(false);
+    expect(runtimeRequiresSeccompProfile("")).toBe(false);
+  });
+});
+
+describe("withBlockIoUringSeccompProfile", () => {
+  it("adds the Localhost io_uring profile while preserving pod security defaults", () => {
+    const podSpec = withBlockIoUringSeccompProfile({
       restartPolicy: "Never",
       automountServiceAccountToken: false,
       securityContext: {
@@ -21,7 +43,8 @@ describe("withRuntimeDefaultSeccompProfile", () => {
         runAsUser: 1000,
         fsGroup: 1000,
         seccompProfile: {
-          type: "RuntimeDefault",
+          type: "Localhost",
+          localhostProfile: BLOCK_IO_URING_SECCOMP_PROFILE,
         },
       },
     });

apps/supervisor/src/workloadManager/kubernetes.ts

@@ -16,7 +16,7 @@ import { type K8sApi, createK8sApi, type k8s } from "../clients/kubernetes.js";
 import { getRunnerId } from "../util.js";
 import {
   runtimeRequiresSeccompProfile,
-  withRuntimeDefaultSeccompProfile,
+  withBlockIoUringSeccompProfile,
 } from "./kubernetesPodSpec.js";
 
 type ResourceQuantities = {
@@ -111,7 +111,7 @@ export class KubernetesWorkloadManager implements WorkloadManager {
     try {
       const basePodSpec = this.addPlacementTags(this.#defaultPodSpec, opts.placementTags);
       const podSpec = runtimeRequiresSeccompProfile(opts.runtime)
-        ? withRuntimeDefaultSeccompProfile(basePodSpec)
+        ? withBlockIoUringSeccompProfile(basePodSpec)
         : basePodSpec;
 
       await this.k8s.core.createNamespacedPod({

apps/supervisor/src/workloadManager/kubernetesPodSpec.ts

@@ -1,12 +1,20 @@
 import type { k8s } from "../clients/kubernetes.js";
 
+/**
+ * Path (relative to the kubelet seccomp root, /var/lib/kubelet/seccomp) of the
+ * targeted seccomp profile that blocks only io_uring_setup/enter/register and
+ * allows every other syscall. Must match the profile distributed to worker nodes
+ * by the infra kubeadm config.
+ */
+export const BLOCK_IO_URING_SECCOMP_PROFILE = "profiles/block-io-uring.json";
+
 /**
  * Node >= 24 (libuv >= ~1.52) unconditionally creates io_uring file descriptors,
- * which cannot be checkpointed. Launching those pods under the RuntimeDefault
- * seccomp profile makes io_uring_setup fail so libuv falls back to epoll, keeping
- * the pod checkpointable. "node" (21.x), "node-22" (UV_USE_IO_URING=0 still works)
- * and "bun" do not create these descriptors, so the profile is scoped to node-24+
- * to avoid changing the syscall surface of existing runtimes.
+ * which cannot be checkpointed. Launching those pods under a seccomp profile that
+ * fails io_uring_setup makes libuv fall back to epoll, keeping the pod
+ * checkpointable. "node" (21.x), "node-22" (UV_USE_IO_URING=0 still works) and
+ * "bun" do not create these descriptors, so the profile is scoped to node-24+ to
+ * avoid changing the syscall surface of existing runtimes.
  *
  * Tolerant of an "experimental-" prefix in case a non-normalized value reaches here.
  */
@@ -16,15 +24,22 @@ export function runtimeRequiresSeccompProfile(runtime: string | null | undefined
   return match ? Number(match[1]) >= 24 : false;
 }
 
-export function withRuntimeDefaultSeccompProfile(
+/**
+ * Applies the targeted Localhost profile that blocks only io_uring, preserving any
+ * existing security-context fields. Unlike RuntimeDefault this restricts no other
+ * syscalls, so it cannot break unrelated workloads (browsers, sandboxes, native
+ * threads). Only call this for runtimes where runtimeRequiresSeccompProfile is true.
+ */
+export function withBlockIoUringSeccompProfile(
   podSpec: Omit<k8s.V1PodSpec, "containers">
 ): Omit<k8s.V1PodSpec, "containers"> {
   return {
     ...podSpec,
     securityContext: {
       ...podSpec.securityContext,
       seccompProfile: {
-        type: "RuntimeDefault",
+        type: "Localhost",
+        localhostProfile: BLOCK_IO_URING_SECCOMP_PROFILE,
       },
     },
   };

apps/supervisor/src/workloadManager/types.ts

@@ -41,7 +41,7 @@ export interface WorkloadManagerCreateOptions {
   deploymentFriendlyId: string;
   deploymentVersion: string;
   // Canonical runtime identifier (e.g. "node", "node-22", "node-24"). Used to
-  // scope the RuntimeDefault seccomp profile to runtimes that require it.
+  // scope the io_uring-blocking seccomp profile to runtimes that require it.
   runtime?: string;
   runId: string;
   runFriendlyId: string;