From fa8c4fea454e1479886822cbefa6858c3d3679ce Mon Sep 17 00:00:00 2001
From: jklein <github@justin-klein.de>
Date: Sun, 23 Aug 2026 23:14:54 +0200
Subject: [PATCH] apache-tika: seccompProfile RuntimeDefault in the pod context

Sets seccompProfile.type: RuntimeDefault in the pod security context, so
the container runtime's default syscall filter applies to every container
in the pod.

The value lives in the pod context rather than the container context
because it covers init containers and any container added later without
being repeated; a container that needs a different filter can still
override it under securityContext.container, which wins over the pod
value.

Verified in k3d against real extractions rather than a reachable port:
the -full image loads its parsers dynamically, so a blocked syscall would
surface as HTTP 200 with empty text, not as an error. The PDF parser, the
HTML parser and the detector/metadata path all return the expected
content under the filter, and the kernel reports Seccomp: 2 (filter mode)
inside the container.

Major bump: runtime behavior changes.

Refs #84
---
 apache-tika/Chart.yaml             |  2 +-
 apache-tika/templates/_helpers.tpl |  3 ++-
 apache-tika/values.yaml            | 13 +++++++++++++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/apache-tika/Chart.yaml b/apache-tika/Chart.yaml
index 2842272..7ffda85 100644
--- a/apache-tika/Chart.yaml
+++ b/apache-tika/Chart.yaml
@@ -5,5 +5,5 @@ icon: https://www.apache.org/logos/res/tika/default.png
 
 type: application
 
-version: 9.1.0+up3.3.1.0.full
+version: 10.0.0+up3.3.1.0.full
 appVersion: "3.3.1.0-full"
diff --git a/apache-tika/templates/_helpers.tpl b/apache-tika/templates/_helpers.tpl
index 4f56557..9609cb1 100644
--- a/apache-tika/templates/_helpers.tpl
+++ b/apache-tika/templates/_helpers.tpl
@@ -214,7 +214,8 @@ default probe needs no further context.
 {{- $defaults := dict
       "runAsNonRoot" true
       "runAsUser" 35002
-      "runAsGroup" 35002 -}}
+      "runAsGroup" 35002
+      "seccompProfile" (dict "type" "RuntimeDefault") -}}
 {{- include "apache-tika.defaultedDict" (dict "defaults" $defaults "given" $given "path" "tika.securityContext.pod") -}}
 {{- end -}}
 
diff --git a/apache-tika/values.yaml b/apache-tika/values.yaml
index 2a7022b..9241506 100644
--- a/apache-tika/values.yaml
+++ b/apache-tika/values.yaml
@@ -15,6 +15,19 @@ tika:
       runAsNonRoot: true
       runAsUser: 35002
       runAsGroup: 35002
+      # RuntimeDefault applies the container runtime's default seccomp filter,
+      # which blocks the syscalls a normal workload never makes. It sits in the
+      # pod context on purpose: from here it covers every container in the pod
+      # including init containers, while a container-level seccompProfile would
+      # have to be repeated for each one (and silently missed on the next one
+      # added). A container that genuinely needs a different filter can still
+      # override it under securityContext.container, which wins over this value.
+      #
+      # Verified against a real extraction, not just a reachable port: the
+      # -full image loads its parsers dynamically, so a filter that blocked
+      # one would show up as HTTP 200 with empty text rather than as an error.
+      seccompProfile:
+        type: RuntimeDefault
     container:
       allowPrivilegeEscalation: false
       readOnlyRootFilesystem: true