From fe6839265c9d9feb3906e65d0751c81d38092430 Mon Sep 17 00:00:00 2001
From: jklein <github@justin-klein.de>
Date: Sun, 23 Aug 2026 23:37:42 +0200
Subject: [PATCH] rallly: seccompProfile RuntimeDefault in the pod context

Sets seccompProfile.type: RuntimeDefault in the pod security context, so
the container runtime's default syscall filter applies to every container
in the pod.

The value lives in the pod context rather than the container context
because it covers init containers and any container added later without
being repeated; a container that needs a different filter can still
override it under securityContext.container, which wins over the pod
value.

Verified in k3d against the database path rather than a static page:
under the filter the app opens its connection to Postgres and Prisma
applies all migrations (141 rows in _prisma_migrations, 31 tables
created), and the server-rendered pages answer with HTTP 200. The kernel
reports Seccomp: 2 (filter mode) inside the container.

Major bump: runtime behavior changes.

Refs #84
---
 rallly/Chart.yaml             | 2 +-
 rallly/templates/_helpers.tpl | 3 ++-
 rallly/values.yaml            | 9 +++++++++
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/rallly/Chart.yaml b/rallly/Chart.yaml
index 15d8873..ddb4765 100644
--- a/rallly/Chart.yaml
+++ b/rallly/Chart.yaml
@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/lukevella/rallly/main/apps/landing/publi
 
 type: application
 
-version: 7.0.0+up4.12.3
+version: 8.0.0+up4.12.3
 appVersion: "4.12.3"
 
 maintainers:
diff --git a/rallly/templates/_helpers.tpl b/rallly/templates/_helpers.tpl
index 1360018..e94a9c9 100644
--- a/rallly/templates/_helpers.tpl
+++ b/rallly/templates/_helpers.tpl
@@ -220,7 +220,8 @@ AVD-KSV-0022 for the older deployed chart version (#84).
       "runAsUser" 20000
       "runAsGroup" 1000
       "fsGroup" 1000
-      "fsGroupChangePolicy" "Always" -}}
+      "fsGroupChangePolicy" "Always"
+      "seccompProfile" (dict "type" "RuntimeDefault") -}}
 {{- include "rallly.defaultedDict" (dict "defaults" $defaults "given" $given "path" "rallly.securityContext.pod") -}}
 {{- end -}}
 
diff --git a/rallly/values.yaml b/rallly/values.yaml
index afb1ced..637bff8 100644
--- a/rallly/values.yaml
+++ b/rallly/values.yaml
@@ -62,6 +62,15 @@ rallly:
       runAsGroup: 1000
       fsGroup: 1000
       fsGroupChangePolicy: Always
+      # RuntimeDefault applies the container runtime's default seccomp filter,
+      # which blocks the syscalls a normal workload never makes. It sits in the
+      # pod context on purpose: from here it covers every container in the pod
+      # including init containers, while a container-level seccompProfile would
+      # have to be repeated for each one (and silently missed on the next one
+      # added). A container that genuinely needs a different filter can still
+      # override it under securityContext.container, which wins over this value.
+      seccompProfile:
+        type: RuntimeDefault
     container:
       allowPrivilegeEscalation: false
       readOnlyRootFilesystem: true