feat: optional read-only root filesystem for run pods in the Kubernetes supervisor

Offen
  • Stimmt etwas nicht?
#5,078 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
72/100
Issue-Typ
Feature
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
kubernetes, typescript
Bereich
backend, infrastructure

Rechercherichtung

Start with apps/supervisor/src/env.ts, workloadManager/kubernetes.ts, and workloadManager/kubernetesPodSpec.ts; trace how runner security context settings and pod volumes are configured. Check the existing unit tests for runnerSecurityContext and the proposed runnerTmpVolume helper. Done means both opt-in environment variables work as described, default behavior stays unchanged, and the related tests pass.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Is your feature request related to a problem? Please describe.

Self-hosters running Trigger.dev on Kubernetes with Pod Security / policy engines (Kyverno, OPA Gatekeeper, CIS benchmarks, some compliance scanners) are often required to run containers with readOnlyRootFilesystem: true. The supervisor's KUBERNETES_RUNNER_SECURITY_CONTEXT (off/baseline/restricted) doesn't set it, and no Pod Security Standards level requires it, so there is currently no way to get it on run pods without patching the supervisor.

Describe the solution you'd like to see

Add two opt-in supervisor env vars:

  • KUBERNETES_RUNNER_READ_ONLY_ROOT_FILESYSTEM (boolean, default false). When true, sets securityContext.readOnlyRootFilesystem: true on the run-controller container. It composes with any KUBERNETES_RUNNER_SECURITY_CONTEXT level, including off.
  • KUBERNETES_RUNNER_TMP_VOLUME_SIZE_LIMIT (default 256Mi, blank = no per-volume cap). When read-only is enabled, an emptyDir is mounted at /tmp so tasks keep a writable os.tmpdir().

The runner runtime itself doesn't write to disk (IPC over socketpair, logs to stdout, OTLP over HTTP), so a single /tmp volume is sufficient. Default behavior is unchanged.

Describe alternate solutions
  • A mutating admission webhook injecting readOnlyRootFilesystem and a /tmp volume. This works but adds cluster-side machinery for something the supervisor can do natively.
  • Maintaining a fork of the supervisor. This is what we do today and what we'd like to stop doing.
  • Making KUBERNETES_RUNNER_SECURITY_CONTEXT=restricted imply the flag. This would break existing users, since restricted doesn't imply a read-only root.
Additional information

We already run this in a private fork (including unit tests for runnerSecurityContext and the new runnerTmpVolume helper). The change touches apps/supervisor/src/env.ts, workloadManager/kubernetes.ts and workloadManager/kubernetesPodSpec.ts, and is roughly 60 lines of source. If this direction is acceptable, we'd be happy to open a PR once vouched, so we can drop our fork.

Vorherrschende Sprache
TypeScript
Sterne
16.5k
Forks
1.5k
Ø Merge
1 T. 15 Std.
Gemergte PRs (30 T.)
17

Entwicklungsumgebung

Dieses Projekt bietet weder Dev-Container noch Dockerfile noch Beitragsleitfaden – die Einrichtung liegt bei Ihnen. Beginnen Sie mit der README; die allgemeinen Schritte stehen in unserem Leitfaden für den ersten Beitrag.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus triggerdotdev/trigger.dev

Alle Issues in triggerdotdev/trigger.dev

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.