feat(supervisor): configurable security context for run pods

Author: nicktrn

apps/supervisor/src/env.ts

@@ -220,6 +220,7 @@ export const Env = z
     KUBERNETES_RUNNER_SECCOMP_PROFILE_RUNTIMES: z
       .enum(["none", "node-24-plus", "all"])
       .default("node-24-plus"),
+    KUBERNETES_RUNNER_SECURITY_CONTEXT: z.enum(["off", "baseline", "restricted"]).default("off"),
 
     // Pod DNS config — override the cluster default ndots to `KUBERNETES_POD_DNS_NDOTS`.
     // Default k8s ndots is 5: any name with fewer than 5 dots (e.g. `api.example.com`, 2 dots) is first walked

apps/supervisor/src/workloadManager/kubernetes.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 import {
   nodetypeNodeSelector,
   runPodTolerations,
+  runnerSecurityContext,
   withRunnerSeccompProfile,
   withNodeSelector,
 } from "./kubernetesPodSpec.js";
@@ -153,3 +154,24 @@ describe("withRunnerSeccompProfile", () => {
     }
   });
 });
+
+describe("runnerSecurityContext", () => {
+  it("sets nothing when off", () => {
+    expect(runnerSecurityContext("off")).toBeUndefined();
+  });
+
+  it("drops all capabilities and blocks escalation at baseline", () => {
+    expect(runnerSecurityContext("baseline")).toEqual({
+      allowPrivilegeEscalation: false,
+      capabilities: { drop: ["ALL"] },
+    });
+  });
+
+  it("additionally requires a non-root image when restricted", () => {
+    expect(runnerSecurityContext("restricted")).toEqual({
+      allowPrivilegeEscalation: false,
+      capabilities: { drop: ["ALL"] },
+      runAsNonRoot: true,
+    });
+  });
+});

apps/supervisor/src/workloadManager/kubernetes.ts

@@ -17,6 +17,7 @@ import { getRunnerId } from "../util.js";
 import {
   nodetypeNodeSelector,
   runPodTolerations,
+  runnerSecurityContext,
   withRunnerSeccompProfile,
   withNodeSelector,
 } from "./kubernetesPodSpec.js";
@@ -175,6 +176,7 @@ export class KubernetesWorkloadManager implements WorkloadManager {
                   },
                 ],
                 resources: this.#getResourcesForMachine(opts.machine),
+                securityContext: runnerSecurityContext(env.KUBERNETES_RUNNER_SECURITY_CONTEXT),
                 env: [
                   {
                     name: "TRIGGER_DEQUEUED_AT_MS",

apps/supervisor/src/workloadManager/kubernetesPodSpec.ts

@@ -96,3 +96,22 @@ export function withRunnerSeccompProfile(
     },
   };
 }
+
+/**
+ * runnerSecurityContext maps a configured level onto the run container's security
+ * context. "baseline" drops the capability bounding set and blocks setuid
+ * escalation; "restricted" additionally requires a non-root image.
+ */
+export function runnerSecurityContext(
+  level: "off" | "baseline" | "restricted"
+): k8s.V1SecurityContext | undefined {
+  if (level === "off") {
+    return undefined;
+  }
+
+  return {
+    allowPrivilegeEscalation: false,
+    capabilities: { drop: ["ALL"] },
+    ...(level === "restricted" ? { runAsNonRoot: true } : {}),
+  };
+}