Youssuf Elshall 9617ca4a58 fix(ateom-gvisor): declare seccompProfile Unconfined so the worker survives RuntimeDefault (#1369) ...

Fixes #1368

The gVisor worker leaves `seccompProfile` unset and relies on the
runtime default. `runsc`'s gofer/boot child processes `pivot_root()`
while setting up the sandbox rootfs, and the default seccomp profile
denies `pivot_root` whatever capabilities the worker holds — the same
reason the microVM worker already declares `Unconfined`. On a cluster
that defaults pod seccomp to `RuntimeDefault` (e.g. via an admission
policy), the sandbox child dies during startup and `runsc create` fails
with `cannot read client sync file: waiting for sandbox to start: EOF`.

This declares `Unconfined` explicitly for the gVisor worker too,
mirroring the microVM branch. It relaxes the filter only on gVisor's own
control processes; the actor workload inside the sandbox remains
confined by the sentry's own seccomp.

> This change was prepared with AI assistance; I have reviewed and
tested it.

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR

2026-09-01 15:32:11 -07:00

..

internal

fix(ateom-gvisor): declare seccompProfile Unconfined so the worker survives RuntimeDefault (#1369)

2026-09-01 15:32:11 -07:00

main_test.go

feat(otel): onboard atecontroller to the OTLP path (#754)

2026-08-06 10:25:03 -04:00

main.go

Full cutover: Drop the k8s CRD ActorTemplate fields in the ate apiserver, and update e2e tests (#1353)

2026-09-01 14:02:59 -04:00