fix kind in camel-k template

Author: michalvavrik

Containerfile

@@ -2,7 +2,7 @@ FROM registry.fedoraproject.org/fedora:44
 
 # ── System packages ──────────────────────────────────────────────────────────
 RUN dnf install -y --setopt=retries=5 \
-        git git-lfs curl wget jq zip unzip findutils procps-ng hostname \
+        git git-lfs curl wget jq yq zip unzip findutils procps-ng hostname \
         diffutils less iproute iptables openssh-server \
         podman fuse-overlayfs e2fsprogs maven nodejs npm gh \
         gcc gcc-c++ make java-devel podman-compose golang \

README.md

@@ -29,6 +29,17 @@ Ephemeral, microVM-isolated dev containers for AI-assisted development. Each con
 - **MCP whitelist** — only explicitly whitelisted MCP servers are proxied into containers (see `MCP_WHITELIST` in `scripts/dev-proxy.py`)
 - **Selective key mounting** — only specific key files are mounted into containers (container SSH pubkey, read-only GitHub PAT); host-only keys like `id_ed25519_dev_automation` never enter containers. The Bob API key is injected via `podman secret` (never volume-mounted)
 
+### The `kind` profile weakens in-VM isolation
+
+Containers using the `kind` profile (currently only camel-k) auto-create a Kubernetes cluster with **rootful podman inside the VM**. This is required, not a shortcut: the `kindest/node` image runs systemd, which needs a root-owned cgroup that the unprivileged `dev` user cannot create — this microVM has no systemd/cgroup delegation, so rootless Kind cannot boot here. (Also, the node's kubelet needs a real block device for its rootfs, so Kind/registry storage is pinned to the bounded podman disk rather than the virtiofs root.)
+
+**Consequence — for these containers, treat the `dev`-vs-root boundary *inside the VM* as gone.** Kind's kubeconfig is cluster-admin, so the agent has a practical, non-exploit path to VM-root (cluster-admin → privileged pod → node container, which runs as VM-root). That means:
+
+- The per-container disk caps and root-owned config (guest nftables firewall, `/etc`, `/opt`, the Bob API key file) are no longer protected from the agent.
+- **Residual host risk:** a VM-root agent can write to the container's *uncapped* writable rootfs layer on the host, which could fill the host disk (DoS). Kind/registry image storage itself stays capped (pinned to the bounded podman disk).
+
+**What is _not_ affected:** the KVM boundary still fully contains the VM. Your host filesystem, Google Vertex credentials, and the GitHub-write SSH key never enter the VM, so they remain protected even against a VM-root agent. Non-`kind` containers keep the full rootless posture described above.
+
 ## Prerequisites
 
 - Clone this repo to `~/sandboxing`: `git clone git@github.com:michalvavrik/ai-sandboxing.git ~/sandboxing`
@@ -416,7 +427,7 @@ The `profiles` field in `project-templates.conf` is a comma-separated list that
 |---------|--------|
 | `java`  | Maven cache overlay from host `~/.m2/repository` |
 | `go`    | Sets GOPATH, GOBIN, adds `~/go/bin` to PATH |
-| `kind`  | Auto-creates a Kind cluster with local registry (`localhost:5001`) on first start, 12 GiB podman storage |
+| `kind`  | Auto-creates a **rootful** Kind cluster with local registry (`localhost:5001`) on first start; 20 GiB podman storage. **Weakens in-VM isolation — see [the `kind` profile security note](#the-kind-profile-weakens-in-vm-isolation).** |
 
 ```bash
 # camel-k (profiles: go,kind):
@@ -468,7 +479,7 @@ Host                              krun MicroVM
 └── dev-sandbox-disks/            └── bounded loopback disks (ext4, root:600 inside VM)
     ├── <name>.img (workspace)        ├── /mnt/bounded → /workspace, /home/dev, /tmp, /var
     └── <name>-podman.img             └── /mnt/podman  → rootless Podman storage
-        (6 GiB java, 12 GiB go)          (Testcontainers / Kind nodes)
+        (6 GiB default, 20 GiB kind)      (Testcontainers / rootful Kind nodes)
 ```
 
 ### Bob Shell credential isolation

entrypoint.sh

@@ -153,37 +153,61 @@ STCONF
     runuser -u dev -- bash -c 'cd /run/user/1000 && XDG_RUNTIME_DIR=/run/user/1000 podman system service --time=0 &'
 fi
 
-# ── Kind cluster (auto-create on first start when 'kind' profile is set) ────
+# ── Kind cluster (ROOTFUL — auto-create on first start when 'kind' profile set) ──
+# Runs as VM-root: root's CAP_DAC_OVERRIDE gets past the root-owned 555 /sys/fs/cgroup
+# so the kindest/node systemd can create its cgroups. The unprivileged dev user cannot
+# (this microVM has no systemd/cgroup delegation, so rootless Kind is impossible here).
+# Root podman storage is pinned to the bounded podman disk (loop-backed ext4): this caps
+# Kind/registry image growth AND gives kubelet/cAdvisor a real block device for the node
+# rootfs — a virtiofs root fails with "no partition info for device /dev/root".
+# SECURITY: kind-profile containers therefore run Kubernetes as VM-root, and the agent
+# can reach VM-root via the cluster (cluster-admin -> privileged pod -> node). See the
+# "kind profile" security note in README. The KVM boundary still contains everything.
 if _has_profile kind && command -v kind &>/dev/null; then
-    _kind_wait=0
-    while ! runuser -u dev -- podman info &>/dev/null && (( _kind_wait < 30 )); do
-        sleep 1; _kind_wait=$(( _kind_wait + 1 ))
-    done
-
-    if runuser -u dev -- podman info &>/dev/null; then
-        if ! runuser -u dev -- bash -c 'export KIND_EXPERIMENTAL_PROVIDER=podman; kind get clusters 2>/dev/null' | grep -q "dev-k8s"; then
-            echo "Creating Kind cluster with local registry..."
-            runuser -u dev -- bash -c '
-                export KIND_EXPERIMENTAL_PROVIDER=podman
-                podman run -d --restart=always -p 127.0.0.1:5001:5000 --name kind-registry registry:2 2>/dev/null || true
-                cat <<KINDCFG | kind create cluster --name dev-k8s --wait 120s --config=-
+    # Kubernetes needs higher limits than the krun defaults (real guest kernel — settable).
+    sysctl -w fs.inotify.max_user_instances=512 fs.inotify.max_user_watches=1048576 \
+        kernel.pid_max=32768 >/dev/null 2>&1 || true
+
+    mkdir -p /mnt/podman/root-storage /mnt/podman/root-run
+    cat > /etc/containers/kind-root-storage.conf <<'ROOTSTORE'
+[storage]
+driver = "overlay"
+graphroot = "/mnt/podman/root-storage"
+runroot = "/mnt/podman/root-run"
+ROOTSTORE
+    export CONTAINERS_STORAGE_CONF=/etc/containers/kind-root-storage.conf
+    export KIND_EXPERIMENTAL_PROVIDER=podman
+
+    # Returns kind's exit code, so success/failure is detected correctly.
+    _dev_kind_create() {
+        podman run -d --restart=always -p 127.0.0.1:5001:5000 \
+            --name kind-registry docker.io/library/registry:2 2>/dev/null || true
+        kind create cluster --name dev-k8s --wait 120s --config=- <<KINDCFG
 kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 containerdConfigPatches:
 - |-
   [plugins."io.containerd.grpc.v1.cri".registry.mirrors."localhost:5001"]
     endpoint = ["http://kind-registry:5001"]
 KINDCFG
-                podman network connect kind kind-registry 2>/dev/null || true
-            ' && echo "Kind cluster ready. Registry at localhost:5001" \
-              || echo "WARNING: Kind cluster creation failed — create manually with: kind create cluster --name dev-k8s" >&2
+    }
+
+    if ! kind get clusters 2>/dev/null | grep -q "dev-k8s"; then
+        echo "Creating rootful Kind cluster with local registry..."
+        if _dev_kind_create; then
+            podman network connect kind kind-registry 2>/dev/null || true
+            install -o dev -g dev -d /home/dev/.kube
+            kind get kubeconfig --name dev-k8s > /home/dev/.kube/config
+            chown dev:dev /home/dev/.kube/config
+            echo "Kind cluster ready. Registry at localhost:5001"
         else
-            runuser -u dev -- bash -c 'podman start dev-k8s-control-plane kind-registry 2>/dev/null' || true
-            echo "Kind cluster already exists."
+            echo "WARNING: Kind cluster creation failed — create manually (as root): KIND_EXPERIMENTAL_PROVIDER=podman kind create cluster --name dev-k8s" >&2
         fi
     else
-        echo "WARNING: podman not ready, skipping Kind cluster setup" >&2
+        podman start dev-k8s-control-plane kind-registry 2>/dev/null || true
+        echo "Kind cluster already exists."
     fi
+    unset CONTAINERS_STORAGE_CONF
 fi
 
 # ── Maven cache (fuse-overlayfs as dev user) ────────────────────────────────

scripts/dev-common.sh

@@ -31,7 +31,8 @@ _dev_has_profile() {
 _dev_podman_storage_gib() {
     local _dev_profiles="${1:-java}"
     if _dev_has_profile "$_dev_profiles" "kind"; then
-        echo 12
+        # Shared by dev's rootless storage and root's Kind storage (see entrypoint.sh).
+        echo 20
     else
         echo 6
     fi