feat(compute): make the guest lane shippable and selectable

Mono-RevId: c893ea0934c69e8fe8ec6f45eaf7be8487e4886b

Author: 1stvamp

apps/supervisor/src/env.ts

@@ -183,6 +183,14 @@ export const Env = z
     // the pod here. The two are mutually exclusive by construction: whichever
     // one runs is the only thing that creates a workload for a cold start.
     KUBERNETES_RUN_CRD_ENABLED: BoolEnv.default(false),
+    // Which isolation lane a Runner asks for. Cell-wide rather than per run,
+    // because a cell's node pools decide what it can serve and nothing on a
+    // dequeued message can express the choice. Ignored unless the run-crd
+    // backend is the one running: the pod backends have no guest lane.
+    //
+    // Not to be confused with the task runtime (node-24, bun), which rides on
+    // the same Runner as taskRuntime and says which interpreter the task needs.
+    KUBERNETES_RUNNER_RUNTIME: z.enum(["container", "microvm"]).default("container"),
     KUBERNETES_NAMESPACE: z.string().default("default"),
     KUBERNETES_WORKER_NODETYPE_LABEL: NodeLabelValue.default("v4-worker"),
     KUBERNETES_IMAGE_PULL_SECRETS: z.string().optional(), // csv

apps/supervisor/src/index.ts

@@ -195,6 +195,7 @@ class ManagedSupervisor {
       this.workloadManager = new RunCrdWorkloadManager({
         ...workloadManagerOptions,
         namespace: env.KUBERNETES_NAMESPACE,
+        runtime: env.KUBERNETES_RUNNER_RUNTIME,
       });
       this.workloadManagerBackend = "run-crd";
     } else if (this.isKubernetes) {

apps/supervisor/src/workloadManager/runCrd.test.ts

@@ -4,7 +4,7 @@ import { runnerBodyFor, runnerTokenSecretName } from "./runCrd.js";
 import { getRunnerId } from "../util.js";
 import type { WorkloadManagerCreateOptions } from "./types.js";
 
-const meta = { name: "runner-abc123", namespace: "v4-runs" };
+const meta = { name: "runner-abc123", namespace: "v4-runs", runtime: "container" } as const;
 
 function createOptions(
   overrides: Partial<WorkloadManagerCreateOptions> = {}
@@ -28,6 +28,31 @@ function createOptions(
   };
 }
 
+/**
+ * The isolation lane is the one spec field a cell chooses rather than derives
+ * from the run, so it is the one a refactor can quietly pin. Asserting both
+ * values, rather than that the field is carried, is what catches a literal
+ * creeping back in: a hardcoded "container" passes any test that only ever asks
+ * for a container.
+ */
+describe("runnerBodyFor carries the isolation lane it is given", () => {
+  it.each(["container", "microvm"] as const)("asks for %s", (runtime) => {
+    const body = runnerBodyFor(createOptions(), { ...meta, runtime });
+
+    expect(body.spec.runtime).toBe(runtime);
+  });
+
+  it("leaves the task runtime alone, which is a different field", () => {
+    const body = runnerBodyFor(createOptions({ runtime: "node-24" }), {
+      ...meta,
+      runtime: "microvm",
+    });
+
+    expect(body.spec.runtime).toBe("microvm");
+    expect(body.spec.taskRuntime).toBe("node-24");
+  });
+});
+
 describe("runnerBodyFor", () => {
   it("names the object after the runner and carries the required spec", () => {
     const body = runnerBodyFor(createOptions(), meta);

apps/supervisor/src/workloadManager/runCrd.ts

@@ -19,9 +19,20 @@ const TOKEN_KEY = "token";
 
 type OwnerReference = { apiVersion: string; kind: string; name: string; uid: string };
 
+/** The isolation lane a Runner asks for, which is the CRD's own enum. */
+export type RunnerRuntime = "container" | "microvm";
+
 export type RunCrdWorkloadManagerOptions = WorkloadManagerOptions & {
   /** Passed in, not read from env, so the translation below is testable alone. */
   namespace: string;
+  /**
+   * Cell-wide, because a cell's node pools decide what it can serve and nothing
+   * on a dequeued message can express a per-run choice. A guest asked for on a
+   * cell with no RuntimeClass fails the Runner rather than falling back, which
+   * is the operator's decision and the right one: a run silently served by the
+   * wrong isolation is worse than one that does not start.
+   */
+  runtime: RunnerRuntime;
 };
 
 /**
@@ -35,18 +46,25 @@ export class RunCrdWorkloadManager implements WorkloadManager {
   private readonly logger = new SimpleStructuredLogger("run-crd-workload-provider");
   private readonly k8s: K8sApi;
   private readonly namespace: string;
+  private readonly runtime: RunnerRuntime;
 
   constructor(opts: RunCrdWorkloadManagerOptions) {
     this.k8s = createK8sApi();
     this.namespace = opts.namespace;
+    this.runtime = opts.runtime;
   }
 
   async create(opts: WorkloadManagerCreateOptions) {
     const runnerId = getRunnerId(opts.runFriendlyId, opts.nextAttemptNumber);
 
     const token = await this.ensureRunnerToken(opts, runnerId);
 
-    const body = runnerBodyFor(opts, { name: runnerId, namespace: this.namespace, token });
+    const body = runnerBodyFor(opts, {
+      name: runnerId,
+      namespace: this.namespace,
+      runtime: this.runtime,
+      token,
+    });
 
     this.logger.verbose("[RunCrdWorkloadManager] Creating runner", { runnerId, body });
 
@@ -253,7 +271,12 @@ function uidOf(created: unknown): string | undefined {
  */
 export function runnerBodyFor(
   opts: WorkloadManagerCreateOptions,
-  meta: { name: string; namespace: string; token?: { name: string; key: string } }
+  meta: {
+    name: string;
+    namespace: string;
+    runtime: RunnerRuntime;
+    token?: { name: string; key: string };
+  }
 ) {
   return {
     apiVersion: `${GROUP}/${VERSION}`,
@@ -264,7 +287,7 @@ export function runnerBodyFor(
       namespace: meta.namespace,
     },
     spec: {
-      runtime: "container",
+      runtime: meta.runtime,
       // As built, digest and all: the operator owns stripping and rewriting, so
       // they cannot both apply.
       image: opts.image,

hosting/k8s/helm/templates/supervisor.yaml

@@ -180,10 +180,18 @@ spec:
               value: {{ .Values.supervisor.config.kubernetes.forceEnabled | quote }}
             - name: KUBERNETES_RUN_CRD_ENABLED
               value: {{ .Values.supervisor.config.kubernetes.runCrdEnabled | quote }}
+            - name: KUBERNETES_RUNNER_RUNTIME
+              value: {{ .Values.supervisor.config.kubernetes.runnerRuntime | quote }}
             {{- range .Values.supervisor.extraEnvVars }}
             {{- if eq .name "KUBERNETES_RUN_CRD_ENABLED" }}
             {{- fail "Set supervisor.config.kubernetes.runCrdEnabled rather than overriding KUBERNETES_RUN_CRD_ENABLED through extraEnvVars. extraEnvVars is rendered last, so the override would win and enable the backend while the Role still lacks the two writes it needs, giving a 403 on every cold start." }}
             {{- end }}
+            {{- if eq .name "KUBERNETES_RUNNER_RUNTIME" }}
+            {{- fail "Set supervisor.config.kubernetes.runnerRuntime rather than overriding KUBERNETES_RUNNER_RUNTIME through extraEnvVars. extraEnvVars is rendered last, so the override would win and ask for a lane the chart has not checked." }}
+            {{- end }}
+            {{- end }}
+            {{- if not (has .Values.supervisor.config.kubernetes.runnerRuntime (list "container" "microvm")) }}
+            {{- fail "supervisor.config.kubernetes.runnerRuntime must be container or microvm, matching the Runner CRD's own enum. Anything else is refused by the API server at create time, which is one dequeued run lost per attempt." }}
             {{- end }}
             - name: KUBERNETES_WORKER_NODETYPE_LABEL
               value: {{ .Values.supervisor.config.kubernetes.workerNodetypeLabel | quote }}

hosting/k8s/helm/values.yaml

@@ -307,6 +307,19 @@ supervisor:
       # the create 404s without them. Also grants the two writes the backend
       # needs, a Secret for the deployment token and the Runner itself.
       runCrdEnabled: false
+      # Which isolation lane a Runner asks for: "container", or "microvm" for a
+      # Firecracker guest. Only read when runCrdEnabled is on, since the pod
+      # backends have no guest lane. Cell-wide rather than per run, because the
+      # node pools decide what can be served.
+      #
+      # A guest needs a RuntimeClass and a runtime handler on the node; the
+      # operator treats an unset microVM.runtimeClassName as an error rather
+      # than falling back to a container, so a half-installed cluster fails the
+      # Runner instead of quietly running the workload unisolated.
+      #
+      # Not to be confused with the task runtime (node-24, bun), which rides on
+      # the same Runner and says which interpreter the task needs.
+      runnerRuntime: container
     podCleaner:
       enabled: true
       batchSize: 100