Add seccomp profile generator with CI verification - #370
Open
mertbozfakioglu wants to merge 6 commits into
Open
Conversation
Add a generate.sh script that derives nsjail-seccomp.json and gvisor-seccomp.json from the upstream Docker default seccomp profile (moby/profiles@61eaf32) plus Retool-specific additions, replacing the hand-maintained profiles with reproducible generated output. The nsjail profile preserves the Docker default structure and inserts an unconditional ALLOW block for the 6 syscalls nsjail needs. The gvisor profile flattens all Docker default rules for x86_64/aarch64 into one allowlist (errno ENOSYS), then adds labelled gVisor/pasta rule groups. Regenerating the gvisor profile picks up ~15 newer syscalls from the current Docker default (getxattrat, listmount, mseal, personality, statmount, uretprobe, etc.) that the hand-crafted version was missing. A CI workflow verifies checked-in profiles match the generator output. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
|
| Filename | Overview |
|---|---|
| charts/retool/seccomp/generate.sh | Adds the pinned upstream fetch and deterministic generation/checking flow for both seccomp profiles. |
| .github/workflows/seccomp-profiles-synced.yaml | Adds path-filtered CI verification and now pins checkout to a full commit SHA. |
| charts/retool/files/gvisor-seccomp.json | Replaces the manually maintained gVisor profile with generator output and additional required syscall groups. |
| charts/retool/files/nsjail-seccomp.json | Regenerates the nsjail profile from the pinned upstream default plus nsjail-specific allowances. |
Reviews (2): Last reviewed commit: "Bump chart version to 6.11.26" | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
…ons pattern Instead of flattening the Docker default into a monolithic allowlist for gVisor, both profiles now use the same structure: Docker default as-is, with labelled unconditional ALLOW rules inserted before the capability- gated section. For gVisor the header is also patched (defaultErrnoRet → ENOSYS, archMap narrowed to x86_64 + aarch64). This makes the generator logic a shared insert_rules helper called by both profiles, and makes the output trivially diffable against Docker default — a customer can see exactly which syscalls Retool adds and why. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Each profile now starts with a comment field linking to the upstream Docker default commit and naming the generator script. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Cache file now includes the upstream commit in its name, so changing UPSTREAM_COMMIT in generate.sh invalidates the stale cache automatically. - Pin actions/checkout to its v3 commit SHA to make the CI dependency immutable. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
3 tasks
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
mertbozfakioglu
marked this pull request as ready for review
September 11, 2026 18:26
mertbozfakioglu
requested review from
jamie-retool,
mako-taco,
stephanretool and
westrik
September 11, 2026 18:26
Contributor
Author
|
@greptile review again |
mertbozfakioglu
commented
Sep 11, 2026
| local patched | ||
| patched="$(mktemp)" | ||
| jq ' | ||
| .defaultErrnoRet = 38 | |
Contributor
Author
There was a problem hiding this comment.
@westrik I'd appreciate a closer look at the err number and architecture bits
Contributor
There was a problem hiding this comment.
defaultErrnoRet should be 38 (ENOSYS) to avoid a gvisor panic on older Linux kernels that don't implement the mseal system call. https://github.com/google/gvisor/blob/release-20260601.0/pkg/sentry/platform/systrap/stub_unsafe.go#L334
archMap is needed to configure how seccomp translates system calls across platforms. Previously we had subarchitectures: [] for aarch64, but I think updating that to match the seccomp default should be safe.
mako-taco
approved these changes
Sep 11, 2026
mako-taco
left a comment
mako-taco
left a comment
Contributor
There was a problem hiding this comment.
The idea seems logical, but someone else who actually understands seccomp can hopefully provide actual review on the generation script.
Contributor
Author
|
Tested the editor flow, backend functions, and published app flow on a self hosted instance and all works as expected |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
charts/retool/seccomp/generate.shthat derivesnsjail-seccomp.jsonandgvisor-seccomp.jsonfrom the pinned upstream Docker default seccomp profile (moby/profiles@61eaf32) plus Retool-specific syscall additionsgenerate.shand re-rungetxattrat,listmount,mseal,personality,statmount,uretprobe, etc.).github/workflows/seccomp-profiles-synced.yaml) that runsgenerate.sh --checkon PRs touching seccomp filesHow it works
nsjail profile: Takes Docker default verbatim (all conditional rules, arg-based rules, full archMap) and inserts one unconditional ALLOW block for the 6 syscalls nsjail needs:
clone,clone2,mount,pivot_root,sethostname,umount2.gVisor profile: Flattens all Docker default ALLOW rules for x86_64 + aarch64 into one sorted allowlist, changes
defaultErrnoRettoENOSYS(38), then adds labelled rule groups for the syscalls gVisor/pasta need beyond the default (clone,clone3,unshare,setns,sethostname,mount,umount2,pivot_root,ptrace).Updating the upstream pin
Test plan
generate.shproduces both profiles without errorsgenerate.sh --checkpasses (generated output matches checked-in files)🤖 Generated with Claude Code