Omar SobhandClaude Fable 5
05e9612688
- K8sDriver.with_localhost_seccomp(profile): sandbox pods run under the STRICT allowlist instead of the runtime default. Proven live on kind: the harness installs the profile onto the node, a pod runs ordinary work as uid 10001, and unshare is kernel-denied inside the pod — the same probe the Docker suite uses, now passing on both targets - Helm: sandbox.seccomp=localhost renders a DaemonSet that installs the chart-shipped profile into /var/lib/kubelet/seccomp on every node (ConfigMap + hostPath); ci/check-helm.sh enforces the chart copy stays byte-identical to images/seccomp/agent-profile.json and asserts the hardened render (DaemonSet + profile + HPA) - server HPA (autoscaling/v2, CPU target) behind server.autoscaling.enabled - SandboxManager.warm(n): a background warmer keeps n pre-provisioned sandboxes ready so an agent's first exec skips container startup; unhealthy pool entries are discarded, reuse never drains the pool, shutdown destroys assigned AND pooled. [sandbox] warm_pool config (default 0). Real-Docker test: prefill -> assign -> refill -> reuse -> clean shutdown 160 Rust tests + 4 live kind tests. Co-Authored-By: Claude Fable 5 <[email protected]>
80 lines
1.8 KiB
YAML
80 lines
1.8 KiB
YAML
# TeamClaw cloud deployment values.
|
|
|
|
image:
|
|
registry: ghcr.io/teamclaw
|
|
tag: latest
|
|
pullPolicy: IfNotPresent
|
|
|
|
server:
|
|
replicas: 1
|
|
autoscaling:
|
|
enabled: false
|
|
min: 1
|
|
max: 5
|
|
targetCPU: 70
|
|
resources:
|
|
requests: { cpu: 250m, memory: 256Mi }
|
|
limits: { cpu: "1", memory: 512Mi }
|
|
|
|
broker:
|
|
resources:
|
|
requests: { cpu: 50m, memory: 64Mi }
|
|
limits: { cpu: 250m, memory: 128Mi }
|
|
# Master key Secret (key: broker.key); create it before install and BACK
|
|
# IT UP — secrets are unrecoverable without it.
|
|
keySecretName: teamclaw-broker-key
|
|
|
|
frontend:
|
|
replicas: 1
|
|
resources:
|
|
requests: { cpu: 100m, memory: 128Mi }
|
|
limits: { cpu: 500m, memory: 256Mi }
|
|
|
|
database:
|
|
# External/managed Postgres connection string Secret (key: url).
|
|
urlSecretName: teamclaw-database
|
|
|
|
llm:
|
|
# anthropic | openai_compat | scripted
|
|
provider: anthropic
|
|
model: claude-sonnet-4-6
|
|
baseUrl: ""
|
|
# Secret holding ANTHROPIC_API_KEY (key: api-key) for the anthropic provider.
|
|
apiKeySecretName: teamclaw-llm
|
|
|
|
storage:
|
|
# local (PVC) | s3
|
|
backend: local
|
|
dataDir: /var/lib/teamclaw
|
|
pvcSize: 10Gi
|
|
s3:
|
|
endpoint: ""
|
|
bucket: ""
|
|
credentialsSecretName: teamclaw-s3
|
|
|
|
auth:
|
|
# local | oidc | clerk (clerk: issuerUrl is the instance Frontend API,
|
|
# https://<slug>.clerk.accounts.dev)
|
|
mode: oidc
|
|
issuerUrl: ""
|
|
clientId: teamclaw
|
|
# clerk mode: Secret with keys publishable-key + secret-key.
|
|
clerkSecretName: teamclaw-clerk
|
|
|
|
oauth:
|
|
issuerUrl: ""
|
|
clientId: teamclaw
|
|
clientSecretName: teamclaw-oauth
|
|
redirectBase: ""
|
|
|
|
sandbox:
|
|
# runtimeDefault | localhost (localhost installs the strict allowlist
|
|
# profile onto every node via a DaemonSet and runs sandbox pods under it)
|
|
seccomp: runtimeDefault
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: nginx
|
|
host: teamclaw.example.com
|
|
tlsSecretName: ""
|