@telorun/k8s-runner 0.6.0

package/src/k8s/ingress.ts

@@ -0,0 +1,127 @@
+import type { V1Ingress, V1OwnerReference, V1Service } from "@kubernetes/client-node";
+
+import type { K8sRunnerConfig } from "../config.js";
+import type { PortMapping, RunnerEndpoint } from "@telorun/runner-core";
+
+/** OwnerReference to the session Pod so the Service + Ingress are garbage
+ *  collected automatically when the Pod dies — essential for sub-minute
+ *  sessions that would otherwise leak ingress objects. */
+function podOwnerRef(podName: string, podUid: string): V1OwnerReference {
+  return {
+    apiVersion: "v1",
+    kind: "Pod",
+    name: podName,
+    uid: podUid,
+    controller: true,
+    blockOwnerDeletion: true,
+  };
+}
+
+export function buildSessionService(
+  config: K8sRunnerConfig,
+  sessionId: string,
+  podName: string,
+  podUid: string,
+  ports: PortMapping[],
+): V1Service {
+  return {
+    apiVersion: "v1",
+    kind: "Service",
+    metadata: {
+      name: `telo-run-${sessionId}`,
+      namespace: config.sessionNamespace,
+      labels: { "app.kubernetes.io/managed-by": config.managedByLabel },
+      ownerReferences: [podOwnerRef(podName, podUid)],
+    },
+    spec: {
+      selector: { "telo.run/session-id": sessionId },
+      ports: ports.map((p) => ({
+        name: `p${p.port}`,
+        port: p.port,
+        targetPort: p.port,
+        protocol: p.protocol.toUpperCase(),
+      })),
+    },
+  };
+}
+
+/** Host fronting a single tcp port: `<port>-<sessionId>.<domain>`. The port
+ *  rides as a leading label (no dots), so it stays a single label under the base
+ *  domain — matching the docker runner's proxy scheme and compatible with a
+ *  single-label wildcard cert (`*.<domain>`). */
+function hostForPort(config: K8sRunnerConfig, sessionId: string, port: number): string {
+  return `${port}-${sessionId}.${config.sessionIngressBaseDomain}`;
+}
+
+export function buildSessionIngress(
+  config: K8sRunnerConfig,
+  sessionId: string,
+  serviceName: string,
+  podName: string,
+  podUid: string,
+  ports: PortMapping[],
+): { ingress: V1Ingress; hosts: string[] } {
+  // Only tcp ports are HTTP-routable; one host rule per port to the matching
+  // service port, mirroring the docker runner's per-port URLs.
+  const rules = ports
+    .filter((p) => p.protocol === "tcp")
+    .map((p) => ({
+      host: hostForPort(config, sessionId, p.port),
+      http: {
+        paths: [
+          {
+            path: "/",
+            pathType: "Prefix" as const,
+            backend: { service: { name: serviceName, port: { number: p.port } } },
+          },
+        ],
+      },
+    }));
+  const ingress: V1Ingress = {
+    apiVersion: "networking.k8s.io/v1",
+    kind: "Ingress",
+    metadata: {
+      name: `telo-run-${sessionId}`,
+      namespace: config.sessionNamespace,
+      labels: { "app.kubernetes.io/managed-by": config.managedByLabel },
+      ownerReferences: [podOwnerRef(podName, podUid)],
+    },
+    spec: {
+      ...(config.sessionIngressClassName
+        ? { ingressClassName: config.sessionIngressClassName }
+        : {}),
+      // Present the predefined cert (e.g. a Cloudflare Origin cert) so an upstream
+      // in Full (Strict) mode can validate the origin. Only meaningful with routable
+      // hosts; a single wildcard `*.<domain>` Secret covers every session host.
+      ...(config.sessionIngressTlsSecretName && rules.length > 0
+        ? {
+            tls: [{ hosts: rules.map((r) => r.host), secretName: config.sessionIngressTlsSecretName }],
+          }
+        : {}),
+      rules,
+    },
+  };
+  return { ingress, hosts: rules.map((r) => r.host) };
+}
+
+/** Endpoints announced on the `running` status. Every tcp port is fronted by its
+ *  own per-session Ingress host (`<port>-<sessionId>.<domain>`, served on 443) and
+ *  carries an external `url`. udp ports aren't HTTP-routable, so they keep the
+ *  host-less form. Without an ingress base domain, host is left blank for the
+ *  client adapter to fill (parity with docker). */
+export function endpointsFor(
+  config: K8sRunnerConfig,
+  sessionId: string,
+  ports: PortMapping[],
+): RunnerEndpoint[] {
+  if (!config.sessionIngressBaseDomain || ports.length === 0) {
+    return ports.map((p) => ({ host: "", port: p.port, protocol: p.protocol }));
+  }
+  return ports.map((p) => {
+    if (p.protocol !== "tcp") {
+      return { host: "", port: p.port, protocol: p.protocol };
+    }
+    const host = hostForPort(config, sessionId, p.port);
+    return { host, port: p.port, protocol: p.protocol, url: `https://${host}` };
+  });
+}

package/src/k8s/pod-spec.ts

@@ -0,0 +1,180 @@
+import type { V1Pod } from "@kubernetes/client-node";
+
+import type { K8sRunnerConfig } from "../config.js";
+import type { ResolvedLimits } from "../limits.js";
+import type { PortMapping } from "@telorun/runner-core";
+
+export interface BuildPodArgs {
+  config: K8sRunnerConfig;
+  sessionId: string;
+  podName: string;
+  entryRelativePath: string;
+  env: Record<string, string>;
+  ports: PortMapping[];
+  limits: ResolvedLimits;
+  /** Prebuilt per-app image to run. Controllers + module manifests are baked
+   *  into `/telo-cache/{manifests,npm}` (read-only) by the on-cluster build;
+   *  the image is keyed only on the dependency closure, so the per-session body
+   *  is NOT baked — it's delivered to `/app` at boot via the initContainer. */
+  image: string;
+  /** Tokenized, single-use URL the body-delivery initContainer fetches the
+   *  session bundle tarball from (`BundleStore.stageSessionBundle`). */
+  bundleUrl: string;
+  /** When true, run the workload with `--inspect` so the runner can relay its
+   *  kernel debug stream. Binds `0.0.0.0:<INSPECT_PORT>` (reachable only by the
+   *  runner over the cluster pod network — never exposed via Service/Ingress). */
+  inspect: boolean;
+}
+
+/** Port the workload's `--inspect` server binds inside the session container.
+ *  Reached by the runner over the cluster pod network (`http://<podIP>:<port>`);
+ *  never declared as a Service port — only the runner relays the stream out. */
+export const INSPECT_PORT = 9230;
+
+const APP_DIR = "/app";
+const WORK_DIR = "/work";
+/** Baked, read-only deps (`telo install` output). Set via TELO_CACHE_DIR, NOT
+ *  mounted — it lives on the image rootfs, so `telo run --no-cache-write` reads
+ *  it without writing. */
+const DEPS_DIR = "/telo-cache";
+/** Writable HOME / npm scratch under a read-only rootfs. Separate from DEPS_DIR
+ *  (which is now read-only baked deps, not scratch). */
+const HOME_DIR = "/home/telo";
+const TMP_MOUNT = "/tmp";
+
+/**
+ * Builds the session Pod. Hardening that needs no RuntimeClass is always on
+ * (non-root, read-only rootfs, drop-all caps, no service-account token,
+ * seccomp RuntimeDefault); a sandbox RuntimeClass is layered on when configured.
+ *
+ * The body-delivery initContainer fetches the session bundle into the writable
+ * `/app` emptyDir; the session container runs `telo run /app/<entry>
+ * --no-cache-write` reading its deps from the baked, read-only `/telo-cache`.
+ * `readOnlyRootFilesystem` stays on — every write lands on a mounted emptyDir.
+ */
+export function buildSessionPod(args: BuildPodArgs): V1Pod {
+  const { config, limits } = args;
+
+  const resources = {
+    limits: {
+      cpu: limits.cpu,
+      memory: limits.memory,
+      "ephemeral-storage": limits.ephemeralStorage,
+    },
+    requests: {
+      cpu: limits.cpu,
+      memory: limits.memory,
+    },
+  };
+
+  const envVars = Object.entries(args.env).map(([name, value]) => ({ name, value }));
+  // Read deps from the baked, read-only `/telo-cache`; keep HOME/npm scratch on a
+  // separate writable emptyDir under the read-only root filesystem.
+  envVars.push({ name: "TELO_CACHE_DIR", value: DEPS_DIR });
+  envVars.push({ name: "HOME", value: HOME_DIR });
+  envVars.push({ name: "npm_config_cache", value: `${HOME_DIR}/.npm` });
+  envVars.push({ name: "FORCE_COLOR", value: "1" });
+
+  const pod: V1Pod = {
+    apiVersion: "v1",
+    kind: "Pod",
+    metadata: {
+      name: args.podName,
+      namespace: config.sessionNamespace,
+      labels: {
+        "app.kubernetes.io/managed-by": config.managedByLabel,
+        "telo.run/session-id": args.sessionId,
+      },
+    },
+    spec: {
+      restartPolicy: "Never",
+      activeDeadlineSeconds: limits.ttlSeconds,
+      automountServiceAccountToken: false,
+      // Pull the per-app image from a private registry. The Secret must exist in
+      // the session namespace (pull secrets are namespace-scoped).
+      ...(config.build.imagePullSecret
+        ? { imagePullSecrets: [{ name: config.build.imagePullSecret }] }
+        : {}),
+      ...(config.runtimeClass ? { runtimeClassName: config.runtimeClass } : {}),
+      securityContext: {
+        runAsNonRoot: true,
+        runAsUser: 1000,
+        runAsGroup: 1000,
+        fsGroup: 1000,
+        seccompProfile: { type: "RuntimeDefault" },
+      },
+      initContainers: [
+        {
+          // Deliver the per-session body into the writable /app emptyDir. The
+          // image bakes only the dependency closure, so the body arrives here.
+          name: "body-fetch",
+          image: config.initImage,
+          command: ["sh", "-c"],
+          args: [
+            `set -e; wget -qO /tmp/body.tgz "${args.bundleUrl}"; tar xzf /tmp/body.tgz -C ${APP_DIR}`,
+          ],
+          volumeMounts: [
+            { name: "app", mountPath: APP_DIR },
+            { name: "tmp", mountPath: TMP_MOUNT },
+          ],
+          securityContext: hardenedContainerSecurity(),
+        },
+      ],
+      containers: [
+        {
+          name: "session",
+          image: args.image,
+          // The per-app tag is an immutable content hash, so IfNotPresent lets
+          // the kubelet reuse a node-cached layer across runs of the same app.
+          imagePullPolicy: "IfNotPresent",
+          // Run the delivered body by absolute path; `--no-cache-write` reads
+          // the baked deps from TELO_CACHE_DIR and validates in-memory without
+          // touching the read-only cache. WORK_DIR is a writable emptyDir cwd so
+          // the workload's relative paths resolve under readOnlyRootFilesystem.
+          workingDir: WORK_DIR,
+          // 0.0.0.0 (not the CLI's loopback default) lets the runner reach the
+          // debug server across the pod network; the port is never published.
+          command: [
+            "telo",
+            "run",
+            `${APP_DIR}/${args.entryRelativePath}`,
+            "--no-cache-write",
+            ...(args.inspect ? ["--inspect", `0.0.0.0:${INSPECT_PORT}`, "--no-open"] : []),
+          ],
+          env: envVars,
+          stdin: true,
+          stdinOnce: false,
+          tty: true,
+          ...(args.ports.length > 0
+            ? { ports: args.ports.map((p) => ({ containerPort: p.port, protocol: p.protocol.toUpperCase() })) }
+            : {}),
+          resources,
+          volumeMounts: [
+            { name: "app", mountPath: APP_DIR },
+            { name: "work", mountPath: WORK_DIR },
+            { name: "home", mountPath: HOME_DIR },
+            { name: "tmp", mountPath: TMP_MOUNT },
+          ],
+          securityContext: hardenedContainerSecurity(),
+        },
+      ],
+      volumes: [
+        { name: "app", emptyDir: {} },
+        { name: "work", emptyDir: {} },
+        { name: "home", emptyDir: {} },
+        { name: "tmp", emptyDir: {} },
+      ],
+    },
+  };
+
+  return pod;
+}
+
+function hardenedContainerSecurity(): Record<string, unknown> {
+  return {
+    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
+    runAsNonRoot: true,
+    capabilities: { drop: ["ALL"] },
+  };
+}

package/src/limits.test.ts

@@ -0,0 +1,59 @@
+import { describe, expect, it } from "vitest";
+
+import type { LimitCeilings } from "./config.js";
+import { clampLimits, parseCpuMillis, parseMemoryBytes } from "./limits.js";
+
+const CEILINGS: LimitCeilings = {
+  cpu: "50m",
+  memory: "100Mi",
+  ttlSeconds: 3600,
+  ephemeralStorage: "512Mi",
+};
+
+describe("clampLimits — hard ceiling, clamp-down only", () => {
+  it("uses the ceiling when no request is given", () => {
+    expect(clampLimits(CEILINGS, undefined)).toEqual({
+      cpu: "50m",
+      memory: "100Mi",
+      ttlSeconds: 3600,
+      ephemeralStorage: "512Mi",
+    });
+  });
+
+  it("clamps a request that exceeds the ceiling back to the ceiling", () => {
+    const r = clampLimits(CEILINGS, { cpu: "2", memory: "4Gi", ttlSeconds: 99_999 });
+    expect(r.cpu).toBe("50m");
+    expect(r.memory).toBe("100Mi");
+    expect(r.ttlSeconds).toBe(3600);
+  });
+
+  it("honors a request that asks for LESS than the ceiling", () => {
+    const r = clampLimits(CEILINGS, { cpu: "20m", memory: "64Mi", ttlSeconds: 600 });
+    expect(r.cpu).toBe("20m");
+    expect(r.memory).toBe("64Mi");
+    expect(r.ttlSeconds).toBe(600);
+  });
+
+  it("falls back to the ceiling on an unparseable request", () => {
+    const r = clampLimits(CEILINGS, { cpu: "garbage", memory: "??" });
+    expect(r.cpu).toBe("50m");
+    expect(r.memory).toBe("100Mi");
+  });
+});
+
+describe("quantity parsers", () => {
+  it("parses cpu to millicores", () => {
+    expect(parseCpuMillis("50m")).toBe(50);
+    expect(parseCpuMillis("1")).toBe(1000);
+    expect(parseCpuMillis("0.5")).toBe(500);
+    expect(parseCpuMillis("nope")).toBeNull();
+  });
+
+  it("parses memory to bytes (binary + SI)", () => {
+    expect(parseMemoryBytes("100Mi")).toBe(100 * 1024 * 1024);
+    expect(parseMemoryBytes("1Gi")).toBe(1024 ** 3);
+    expect(parseMemoryBytes("1000")).toBe(1000);
+    expect(parseMemoryBytes("5M")).toBe(5_000_000);
+    expect(parseMemoryBytes("bad")).toBeNull();
+  });
+});

package/src/limits.ts

@@ -0,0 +1,90 @@
+import type { LimitCeilings } from "./config.js";
+
+/**
+ * Effective per-session resource limits. Requests may ask for LESS than the
+ * ceiling but never MORE — `min(requested, ceiling)`. Without a control plane
+ * the editor talks to the runner directly, so a raisable limit would void the
+ * cap; clamp-down-only is the load-bearing invariant.
+ */
+export interface ResolvedLimits {
+  cpu: string;
+  memory: string;
+  ttlSeconds: number;
+  ephemeralStorage: string;
+}
+
+export interface RequestedLimits {
+  cpu?: string;
+  memory?: string;
+  ttlSeconds?: number;
+  ephemeralStorage?: string;
+}
+
+export function clampLimits(
+  ceilings: LimitCeilings,
+  requested: RequestedLimits | undefined,
+): ResolvedLimits {
+  return {
+    cpu: clampQuantity(ceilings.cpu, requested?.cpu, parseCpuMillis),
+    memory: clampQuantity(ceilings.memory, requested?.memory, parseMemoryBytes),
+    ephemeralStorage: clampQuantity(
+      ceilings.ephemeralStorage,
+      requested?.ephemeralStorage,
+      parseMemoryBytes,
+    ),
+    ttlSeconds:
+      requested?.ttlSeconds && requested.ttlSeconds > 0
+        ? Math.min(requested.ttlSeconds, ceilings.ttlSeconds)
+        : ceilings.ttlSeconds,
+  };
+}
+
+/** Returns `requested` only when it parses AND is <= ceiling; otherwise the
+ *  ceiling. Any unparseable/oversized request silently clamps to the cap. */
+function clampQuantity(
+  ceiling: string,
+  requested: string | undefined,
+  parse: (q: string) => number | null,
+): string {
+  if (!requested) return ceiling;
+  const r = parse(requested);
+  const c = parse(ceiling);
+  if (r === null || c === null) return ceiling;
+  return r <= c ? requested : ceiling;
+}
+
+/** CPU → millicores. "500m" → 500; "1" → 1000; "0.5" → 500. */
+export function parseCpuMillis(q: string): number | null {
+  const s = q.trim();
+  if (s.endsWith("m")) {
+    const n = Number(s.slice(0, -1));
+    return Number.isFinite(n) ? n : null;
+  }
+  const n = Number(s);
+  return Number.isFinite(n) ? Math.round(n * 1000) : null;
+}
+
+const MEMORY_SUFFIXES: Record<string, number> = {
+  Ki: 1024,
+  Mi: 1024 ** 2,
+  Gi: 1024 ** 3,
+  Ti: 1024 ** 4,
+  K: 1000,
+  M: 1000 ** 2,
+  G: 1000 ** 3,
+  T: 1000 ** 4,
+  k: 1000,
+};
+
+/** Memory/storage quantity → bytes. Supports binary (Ki/Mi/Gi) and SI (K/M/G). */
+export function parseMemoryBytes(q: string): number | null {
+  const s = q.trim();
+  const match = /^(\d+(?:\.\d+)?)\s*([A-Za-z]+)?$/.exec(s);
+  if (!match) return null;
+  const value = Number(match[1]);
+  if (!Number.isFinite(value)) return null;
+  const suffix = match[2];
+  if (!suffix) return value;
+  const mult = MEMORY_SUFFIXES[suffix];
+  return mult ? value * mult : null;
+}

package/src/server.ts

@@ -0,0 +1,124 @@
+import {
+  BaseImageCatalog,
+  buildServer as coreBuildServer,
+  loadTermsFromEnv,
+  stopAllSessions,
+  type RunnerBackend,
+  type ServerHandle,
+  type SessionConfig,
+} from "@telorun/runner-core";
+
+import packageJson from "../package.json" with { type: "json" };
+import { BundleStore } from "./bundle-store.js";
+import { kubernetesRunnerCapabilities } from "./capabilities.js";
+import { loadK8sRunnerConfig, RunnerConfigError, type K8sRunnerConfig } from "./config.js";
+import { createKubernetesBackend } from "./k8s/backend.js";
+import { createKubeClient } from "./k8s/client.js";
+
+const VERSION: string = packageJson.version;
+
+export interface ServerDeps {
+  backend: RunnerBackend;
+  config: K8sRunnerConfig;
+  bundleStore: BundleStore;
+  /** Base-image catalog whose resolved list becomes the advertised `image`
+   *  enum + the server-side allowlist. Omitted → `image` locks to defaultImage. */
+  catalog?: BaseImageCatalog;
+}
+
+export async function buildServer(deps: ServerDeps): Promise<ServerHandle> {
+  const { catalog } = deps;
+  // Load terms once; the capabilities getter is re-resolved per request so a
+  // refreshed catalog (new tags) shows up without restarting the runner.
+  const terms = loadTermsFromEnv(process.env);
+
+  const handle = await coreBuildServer({
+    backend: deps.backend,
+    config: deps.config,
+    version: VERSION,
+    capabilities: () =>
+      kubernetesRunnerCapabilities(deps.config.defaultImage, terms, catalog?.current()),
+    defaultRegistryUrl: process.env.TELO_REGISTRY_URL,
+    validateConfig: catalog
+      ? (sessionConfig: SessionConfig): string | undefined =>
+          catalog.isAllowed(sessionConfig.image)
+            ? undefined
+            : `base image '${sessionConfig.image}' is not offered by this runner. ` +
+              `Allowed images: ${catalog.current().join(", ")}`
+      : undefined,
+  });
+  // Mount the internal, tokenized fetch route on the same app so a build Job's
+  // initContainer can pull the build-context tarball (bundle + Dockerfile).
+  deps.bundleStore.registerRoute(handle.app);
+  return handle;
+}
+
+async function main(): Promise<void> {
+  let config: K8sRunnerConfig;
+  try {
+    config = loadK8sRunnerConfig(process.env);
+  } catch (err) {
+    if (err instanceof RunnerConfigError) {
+      process.stderr.write(`${err.message}\n`);
+      process.exit(2);
+    }
+    throw err;
+  }
+
+  const kube = createKubeClient();
+  const bundleStore = new BundleStore(config.selfUrl);
+  const backend = createKubernetesBackend({ kube, config, bundleStore });
+
+  const catalog = config.baseImageCatalog.enabled
+    ? new BaseImageCatalog({
+        repository: config.baseImageCatalog.repository,
+        defaultRef: config.defaultImage,
+        filter: config.baseImageCatalog.filter,
+        limit: config.baseImageCatalog.limit,
+        refreshIntervalMs: config.baseImageCatalog.refreshIntervalMs,
+      })
+    : undefined;
+
+  const { app, registry } = await buildServer({ backend, config, bundleStore, catalog });
+
+  // Populate the catalog before serving so the first /v1/capabilities carries the
+  // full menu; a fetch failure degrades to the default image (surfaced, not
+  // swallowed) and the periodic refresh retries.
+  if (catalog) {
+    await catalog
+      .refresh()
+      .catch((err) =>
+        app.log.warn({ err }, "initial base-image catalog refresh failed; serving default image only"),
+      );
+    catalog.start((err) => app.log.warn({ err }, "base-image catalog refresh failed"));
+  }
+
+  // Reap pods orphaned by a prior runner process (in-memory registry).
+  if (backend.reapOrphans) {
+    await backend.reapOrphans().catch((err) => app.log.warn({ err }, "orphan reap failed"));
+  }
+
+  try {
+    await app.listen({ port: config.port, host: "0.0.0.0" });
+  } catch (err) {
+    app.log.error(err);
+    process.exit(1);
+  }
+
+  const shutdown = async (signal: string): Promise<void> => {
+    app.log.info({ signal }, "shutting down");
+    catalog?.stop();
+    for (const entry of registry.list()) entry.userStopped = true;
+    await app.close();
+    await stopAllSessions(registry, app.log);
+    process.exit(0);
+  };
+
+  process.on("SIGTERM", () => void shutdown("SIGTERM"));
+  process.on("SIGINT", () => void shutdown("SIGINT"));
+}
+
+const isEntrypoint = import.meta.url === `file://${process.argv[1]}`;
+if (isEntrypoint) {
+  void main();
+}

package/src/tar.test.ts

@@ -0,0 +1,55 @@
+import { gunzipSync } from "node:zlib";
+import { describe, expect, it } from "vitest";
+
+import { makeBundleTarGz } from "./tar.js";
+
+/** Reads the file names + sizes out of an uncompressed ustar buffer. */
+function listTar(buf: Buffer): Array<{ name: string; size: number; body: string }> {
+  const out: Array<{ name: string; size: number; body: string }> = [];
+  let off = 0;
+  while (off + 512 <= buf.byteLength) {
+    const block = buf.subarray(off, off + 512);
+    const name = block.subarray(0, 100).toString("ascii").replace(/\0.*$/, "");
+    if (name === "") break; // terminator
+    const size = parseInt(block.subarray(124, 136).toString("ascii").replace(/\0.*$/, "").trim(), 8);
+    const body = buf.subarray(off + 512, off + 512 + size).toString("utf8");
+    out.push({ name, size, body });
+    off += 512 + Math.ceil(size / 512) * 512;
+  }
+  return out;
+}
+
+describe("makeBundleTarGz", () => {
+  it("produces a gzip ustar archive round-trippable to the original files", async () => {
+    const gz = await makeBundleTarGz({
+      entryRelativePath: "telo.yaml",
+      files: [
+        { relativePath: "telo.yaml", contents: "kind: Telo.Application\n" },
+        { relativePath: "sub/lib.yaml", contents: "kind: Telo.Library\n" },
+      ],
+    });
+    const entries = listTar(gunzipSync(gz));
+    expect(entries.map((e) => e.name)).toEqual(["telo.yaml", "sub/lib.yaml"]);
+    expect(entries[0]!.body).toBe("kind: Telo.Application\n");
+    expect(entries[1]!.body).toBe("kind: Telo.Library\n");
+  });
+
+  it("rejects traversal paths", async () => {
+    await expect(
+      makeBundleTarGz({
+        entryRelativePath: "telo.yaml",
+        files: [{ relativePath: "../escape", contents: "x" }],
+      }),
+    ).rejects.toThrow();
+  });
+
+  it("rejects paths longer than the 100-byte ustar name field", async () => {
+    const longName = "a/".repeat(60) + "x.yaml"; // > 100 bytes
+    await expect(
+      makeBundleTarGz({
+        entryRelativePath: "telo.yaml",
+        files: [{ relativePath: longName, contents: "x" }],
+      }),
+    ).rejects.toThrow(/too long for tar/);
+  });
+});