docs: document legacy read-only sandbox mode on kernels before 5.19

Kernels without SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV (< 5.19, e.g. RHEL 9.x /
RHCOS 5.14) run the sandbox in a legacy read-only cancellation mode where the
broker fails closed with EOPNOTSUPP on the mediated operations that write results
back into workload memory (getpeername, accept/accept4 with a non-null address,
sendmmsg length write-backs). Document this observable behavior and its syscall
limitations in the public Fern docs: the support-matrix kernel requirements and
the OpenShift runtime guidance.

Signed-off-by: Akram <akram.benaissi@gmail.com>

Author: akram

docs/kubernetes/openshift.mdx

@@ -19,6 +19,21 @@ process to install a nested seccomp user-notification filter and use Landlock.
 OpenShell fails sandbox startup when either capability-free runtime probe fails.
 </Warning>
 
+## Node kernel and legacy read-only mode
+
+OpenShift nodes run RHCOS, which currently ships a RHEL 9.x kernel (5.14). That
+kernel predates `SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV` (Linux 5.19), so the
+sandbox starts in a reduced **legacy read-only** cancellation mode. Isolation is
+unchanged, but the broker fails closed with `EOPNOTSUPP` on the mediated
+operations that write results back into workload memory — `getpeername`,
+`accept`/`accept4` with a non-null peer-address argument, and `sendmmsg`
+per-message length write-backs. Outbound-oriented workloads run unchanged;
+server workloads that read the peer address on accept need a node kernel with
+`WAIT_KILLABLE_RECV` (Linux 5.19+, or a distribution backport). See the
+[support matrix](/reference/support-matrix#legacy-read-only-mode-kernels-before-linux-519)
+for the full behavior; the selected mode is reported as `seccomp_listener_mode`
+in the sandbox qualification output.
+
 ## Prerequisites
 
 - OpenShift 4.x cluster with `oc` configured.

docs/reference/support-matrix.mdx

@@ -103,12 +103,37 @@ when it runs inside a container or microVM:
 | -------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | [Landlock LSM](https://docs.kernel.org/security/landlock.html) | Required | ABI 3 or newer, introduced in Linux 6.2, with Landlock enabled. The mandatory baseline protects private channel and bootstrap files, including against truncation. A filesystem policy's `best_effort` setting never disables this baseline. |
 | seccomp | Required | Nested user-notification filters and atomic `SECCOMP_IOCTL_NOTIF_ADDFD` with `SECCOMP_ADDFD_FLAG_SEND`, usable under the runtime's existing seccomp profile without added capabilities. The sandbox actively probes these operations before admitting the workload. |
+| seccomp `WAIT_KILLABLE_RECV` | Recommended (Linux 5.19+) | Keeps a notified workload thread in a kill-only wait so the broker can safely write mediated results into workload memory. Without it (kernels < 5.19, for example RHEL 9.x / RHCOS 5.14) the sandbox still starts, in a reduced **legacy read-only** mode described below. |
 
 A kernel version alone does not establish support. A disabled Landlock LSM or a
 runtime profile that blocks the required seccomp operations causes launch to
 fail closed. An upstream Linux 6.2 or newer kernel provides the required
 Landlock ABI; distribution backports must pass the same active qualification.
 
+### Legacy read-only mode (kernels before Linux 5.19)
+
+`SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV` was added in Linux 5.19. On older
+kernels — notably RHEL 9.x and RHCOS, which ship a 5.14 kernel — the sandbox
+cannot install a kill-only listener, so it falls back to a plain listener and
+runs in a **legacy read-only** cancellation mode. The sandbox starts and
+enforces the full isolation boundary (Landlock, the outer NetworkPolicy fence,
+DNS and TCP authorization); the only difference is that the broker refuses the
+mediated operations that write results back into workload memory, failing them
+closed with `EOPNOTSUPP`:
+
+- `getpeername`;
+- `accept` / `accept4` **when a non-null peer-address argument is supplied**
+  (a null address argument still works);
+- `sendmmsg` paths that write per-message lengths back to the caller.
+
+Socket creation, `connect`, `bind`, `listen`, `sendto`, and `sendmsg` are
+unaffected. Outbound-oriented workloads generally run unchanged; server
+workloads whose accept wrappers request the peer address will see `EOPNOTSUPP`
+until the node runs a kernel that provides `WAIT_KILLABLE_RECV` (Linux 5.19+, or
+a distribution backport). The selected mode is reported in the sandbox
+qualification output as `seccomp_listener_mode` (`killable` or
+`legacy_read_only`).
+
 On macOS, these kernel modules run inside the Docker Desktop Linux VM, not on the host kernel.
 
 ## Agent Compatibility