feat(gvisor): selectable gVisor runtime tier for tenant sandboxes - #9
Merged
Conversation
snese
marked this pull request as ready for review
June 25, 2026 10:06
RuntimeClass gvisor (handler runsc) + dedicated tainted gVisor EC2NodeClass (AL2023 ARM64, runsc shim via user-data, containerd v2 io.containerd.cri.v1 runtime path) + gVisor NodePool (arm64, taint openclaw/runtime=gvisor, label in requirements). Verified in a live spike: Pod Identity works under gVisor, so the tenant IAM model is unchanged. Part of #5.
…se 2) When sandbox.runtimeClassName=gvisor, the per-tenant SandboxTemplate sets runtimeClassName and tolerates the gVisor NodePool taint (RuntimeClass scheduling also injects nodeSelector+toleration). Document the value and add a third helm-lint variant for the gvisor tier. Part of #5.
…sion contract - Weighted NodePools: arm64 (Graviton, weight 100, preferred) + amd64 fallback (weight 10) sharing one arch-agnostic EC2NodeClass (userData resolves runsc via uname -m; tenant image is multi-arch). - RuntimeClass overhead.podFixed (128Mi/50m) so scheduler + Karpenter account for the per-pod gVisor Sentry. - ADR-0007: mechanism honesty table (what each isolation layer stops and does not stop), runtime tier extension contract (4 seams), tier policy (at most two tiers; new hardened tiers replace, not accumulate). - scripts/conformance-runtime-tier.sh: codifies the 4-point E2E gate (kernel identity, Pod Identity, EFS RWX, Bedrock reachability) required by the extension contract.
snese
force-pushed
the
feat/gvisor-runtime-tier
branch
from
July 14, 2026 06:52
4d3b3f7 to
f16d822
Compare
snese
changed the title
3 tasks
…eal conformance gates - Pin gVisor to dated release 20260706 with sha512 verification and curl --retry 3 (was: unpinned 'latest', no checksum). - Drop platform=ptrace from runsc.toml: runsc defaults to systrap; ptrace is deprecated upstream. - Move maxPods to EC2NodeClass spec.kubelet so Karpenter accounts for it in node capacity (was: raw userData NodeConfig, invisible to Karpenter). - Conformance: Pod Identity check now performs an AUTHENTICATED credential fetch (token from AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE) and asserts AccessKeyId — previously an unauthenticated 401 could never fail the pipe-masked check. Bedrock check renamed to honest reachability semantics (2xx-4xx = reached; timeouts fail). - Remove dead scheduling_fields variable.
Contributor
Author
|
Review + live verification complete (2026-07-14). Multi-agent review verdict: MERGE-AFTER-FIXES — all 5 blockers addressed in the latest commits (pinned runsc 20260706 + sha512 verify + retry; systrap default; authenticated Pod Identity conformance gate; honest Bedrock reachability semantics; kubelet maxPods moved to EC2NodeClass). Live E2E on a CDK-updated cluster (UPDATE_COMPLETE), post-fix:
Merging. |
This was referenced Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a selectable gVisor (
runsc) kernel-isolation tier to tenant Sandboxes on the all-Graviton (ARM64) EKS cluster, without disturbing the runc tier from #6. Part of #5.gvisorRuntimeClass (handler: runsc) + tainted Karpenter NodePool (AL2023 ARM64, runsc +containerd-shim-runsc-v1via EC2NodeClass userData) + EC2NodeClass.SandboxTemplateselects the tier viasandbox.runtimeClassName: gvisor(adds the gVisor pool nodeSelector + NoSchedule toleration). Default stays runc.Verification (live, not just synth/lint)
Fresh
cdk deployof the full stack on a net-new stack (us-east-1):runtimeClassName=gvisorpod scheduled by Karpenter onto anopenclaw/runtime=gvisorarm64 node →/proc/version = Linux 4.19.0-gvisor,uname -m = aarch64,dmesg"Starting gVisor..." (gVisor kernel, not host).gvisor-RuntimeClass pods land there).CI green: Platform (CDK + Helm + Scripts), CodeQL, Security scan.
Notes
iptables, subset of syscall ABI (workload-dependent), service-mesh sidecars awkward (prefer ambient/sidecarless or Kata).Update (2026-07-14)
weight 100, preferred) + amd64 fallback (weight 10) — sharing one
arch-agnostic
EC2NodeClass(userData resolves the gVisor binary via$(uname -m); the tenant image is published multi-arch).overhead.podFixed(128Mi/50m) so the scheduler andKarpenter account for the per-pod gVisor Sentry.
stops / does not stop), a runtime tier extension contract (the four seams
any future runtime tier plugs into: RuntimeClass, NodePool+NodeClass, the
sandbox.runtimeClassNameHelm value, and a conformance pass), and a tierpolicy (at most two runtime tiers; a new hardened tier replaces the previous
one).
scripts/conformance-runtime-tier.sh: codifies the four-point E2E gate(kernel identity, Amazon EKS Pod Identity reachability, Amazon EFS RWX write,
Amazon Bedrock endpoint reachability) required by the extension contract.