feat(supervisor): select the pinned uid by runtime

Author: nicktrn

apps/supervisor/src/workloadManager/kubernetes.test.ts

@@ -157,22 +157,32 @@ describe("withRunnerSeccompProfile", () => {
 
 describe("runnerSecurityContext", () => {
   it("sets nothing when off", () => {
-    expect(runnerSecurityContext("off", 1000)).toBeUndefined();
+    expect(runnerSecurityContext("off", 1000, "node-24")).toBeUndefined();
   });
 
   it("drops all capabilities and blocks escalation at baseline", () => {
-    expect(runnerSecurityContext("baseline", 1000)).toEqual({
+    expect(runnerSecurityContext("baseline", 1000, "node-24")).toEqual({
       allowPrivilegeEscalation: false,
       capabilities: { drop: ["ALL"] },
     });
   });
 
-  it("additionally requires a non-root image when restricted", () => {
-    expect(runnerSecurityContext("restricted", 1000)).toEqual({
+  it("pins the configured uid when restricted", () => {
+    expect(runnerSecurityContext("restricted", 1000, "node-24")).toEqual({
       allowPrivilegeEscalation: false,
       capabilities: { drop: ["ALL"] },
       runAsNonRoot: true,
       runAsUser: 1000,
     });
   });
+
+  it("pins bun's own uid, which differs from node's", () => {
+    expect(runnerSecurityContext("restricted", 1000, "bun")?.runAsUser).toBe(1001);
+  });
+
+  it("falls back to the configured uid when the runtime is unknown", () => {
+    for (const runtime of [undefined, null, "", "node", "node-22", "node-26"]) {
+      expect(runnerSecurityContext("restricted", 1000, runtime)?.runAsUser).toBe(1000);
+    }
+  });
 });

apps/supervisor/src/workloadManager/kubernetes.ts

@@ -178,7 +178,8 @@ export class KubernetesWorkloadManager implements WorkloadManager {
                 resources: this.#getResourcesForMachine(opts.machine),
                 securityContext: runnerSecurityContext(
                   env.KUBERNETES_RUNNER_SECURITY_CONTEXT,
-                  env.KUBERNETES_RUNNER_RUN_AS_USER
+                  env.KUBERNETES_RUNNER_RUN_AS_USER,
+                  opts.runtime
                 ),
                 env: [
                   {

apps/supervisor/src/workloadManager/kubernetesPodSpec.ts

@@ -97,18 +97,22 @@ export function withRunnerSeccompProfile(
   };
 }
 
+const BUN_RUN_AS_USER = 1001;
+
 /**
  * runnerSecurityContext maps a configured level onto the run container's security
  * context. "baseline" drops the capability bounding set and blocks setuid
  * escalation; "restricted" additionally pins the container to a non-root uid.
  *
- * The uid is set explicitly rather than relying on the image: the kubelet cannot
- * verify `runAsNonRoot` when an image declares a named user, and fails the
- * container instead.
+ * The uid is set explicitly rather than read from the image: the kubelet cannot
+ * verify `runAsNonRoot` against an image that declares a named user, and fails
+ * the container instead. Bun images carry their user at a different uid to
+ * node's, so the runtime selects which uid is pinned.
  */
 export function runnerSecurityContext(
   level: "off" | "baseline" | "restricted",
-  runAsUser: number
+  runAsUser: number,
+  runtime: string | null | undefined
 ): k8s.V1SecurityContext | undefined {
   if (level === "off") {
     return undefined;
@@ -117,6 +121,8 @@ export function runnerSecurityContext(
   return {
     allowPrivilegeEscalation: false,
     capabilities: { drop: ["ALL"] },
-    ...(level === "restricted" ? { runAsNonRoot: true, runAsUser } : {}),
+    ...(level === "restricted"
+      ? { runAsNonRoot: true, runAsUser: runtime === "bun" ? BUN_RUN_AS_USER : runAsUser }
+      : {}),
   };
 }