feat: optional read-only root filesystem for run pods in the Kubernetes supervisor

Aperta
  • Qualcosa non va?
#5,078 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
72/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
kubernetes, typescript
Ambito
backend, infrastructure

Direzione di ricerca

Start with apps/supervisor/src/env.ts, workloadManager/kubernetes.ts, and workloadManager/kubernetesPodSpec.ts; trace how runner security context settings and pod volumes are configured. Check the existing unit tests for runnerSecurityContext and the proposed runnerTmpVolume helper. Done means both opt-in environment variables work as described, default behavior stays unchanged, and the related tests pass.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Is your feature request related to a problem? Please describe.

Self-hosters running Trigger.dev on Kubernetes with Pod Security / policy engines (Kyverno, OPA Gatekeeper, CIS benchmarks, some compliance scanners) are often required to run containers with readOnlyRootFilesystem: true. The supervisor's KUBERNETES_RUNNER_SECURITY_CONTEXT (off/baseline/restricted) doesn't set it, and no Pod Security Standards level requires it, so there is currently no way to get it on run pods without patching the supervisor.

Describe the solution you'd like to see

Add two opt-in supervisor env vars:

  • KUBERNETES_RUNNER_READ_ONLY_ROOT_FILESYSTEM (boolean, default false). When true, sets securityContext.readOnlyRootFilesystem: true on the run-controller container. It composes with any KUBERNETES_RUNNER_SECURITY_CONTEXT level, including off.
  • KUBERNETES_RUNNER_TMP_VOLUME_SIZE_LIMIT (default 256Mi, blank = no per-volume cap). When read-only is enabled, an emptyDir is mounted at /tmp so tasks keep a writable os.tmpdir().

The runner runtime itself doesn't write to disk (IPC over socketpair, logs to stdout, OTLP over HTTP), so a single /tmp volume is sufficient. Default behavior is unchanged.

Describe alternate solutions
  • A mutating admission webhook injecting readOnlyRootFilesystem and a /tmp volume. This works but adds cluster-side machinery for something the supervisor can do natively.
  • Maintaining a fork of the supervisor. This is what we do today and what we'd like to stop doing.
  • Making KUBERNETES_RUNNER_SECURITY_CONTEXT=restricted imply the flag. This would break existing users, since restricted doesn't imply a read-only root.
Additional information

We already run this in a private fork (including unit tests for runnerSecurityContext and the new runnerTmpVolume helper). The change touches apps/supervisor/src/env.ts, workloadManager/kubernetes.ts and workloadManager/kubernetesPodSpec.ts, and is roughly 60 lines of source. If this direction is acceptable, we'd be happy to open a PR once vouched, so we can drop our fork.

Lingua principale
TypeScript
Stelle
16.5k
Fork
1.5k
Merge medio
1g 15h
PR unite (30g)
17

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di triggerdotdev/trigger.dev

Tutte le issue di triggerdotdev/trigger.dev

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.