fix(runtime): remove tokio io-uring feature and add regression guard (#4364)

Drop the [target.'cfg(target_os = "linux")'.dependencies] tokio
"io-uring" feature from 6 crates and the rustfs binary. Because
.cargo/config.toml enables --cfg tokio_unstable globally, this feature
switched every Linux build's file I/O onto tokio's io_uring runtime
backend. Restricted Linux environments (Docker default seccomp, gVisor,
proot, old kernels) reject io_uring_setup with EACCES/ENOSYS, which
tokio surfaced as PermissionDenied and RustFS reported as
DiskAccessDenied at startup.

Add scripts/check_no_tokio_io_uring.sh so the feature cannot silently
return: it fails on any tokio dependency line enabling "io-uring", while
still allowing a future application-level io-uring crate dependency.
Wire it into make pre-commit/pre-pr/dev-check and CI.

Tracking: rustfs/backlog#890 (parent rustfs/backlog#897)

Co-authored-by: heihutu <heihutu@gmail.com>

.config/make/lint-fmt.mak

@@ -45,6 +45,11 @@ logging-guardrails-check: ## Check logging guardrails for redaction and noise re
 	@echo "🪵 Checking logging guardrails..."
 	./scripts/check_logging_guardrails.sh
 
+.PHONY: tokio-io-uring-check
+tokio-io-uring-check: ## Check tokio io-uring runtime feature stays removed
+	@echo "🚫 Checking tokio io-uring feature guard..."
+	./scripts/check_no_tokio_io_uring.sh
+
 .PHONY: compilation-check
 compilation-check: core-deps ## Run compilation check
 	@echo "🔨 Running compilation check..."

.config/make/pre-commit.mak

@@ -14,13 +14,13 @@ doc-paths-check: ## Check that instruction/architecture docs reference existing
 	./scripts/check_doc_paths.sh
 
 .PHONY: pre-commit
-pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check doc-paths-check quick-check ## Run fast pre-commit checks without clippy/full tests
+pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check doc-paths-check quick-check ## Run fast pre-commit checks without clippy/full tests
 	@echo "✅ All pre-commit checks passed!"
 
 .PHONY: pre-pr
-pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check doc-paths-check clippy-check test ## Run full pre-PR checks with clippy and tests
+pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check doc-paths-check clippy-check test ## Run full pre-PR checks with clippy and tests
 	@echo "✅ All pre-PR checks passed!"
 
 .PHONY: dev-check
-dev-check: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check doc-paths-check quick-check ## Run fast local development checks
+dev-check: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check doc-paths-check quick-check ## Run fast local development checks
 	@echo "✅ Fast development checks passed!"

.github/workflows/ci.yml

@@ -143,6 +143,9 @@ jobs:
       - name: Check architecture migration rules
         run: ./scripts/check_architecture_migration_rules.sh
 
+      - name: Check tokio io-uring feature guard
+        run: ./scripts/check_no_tokio_io_uring.sh
+
   test-and-lint:
     name: Test and Lint
     needs: skip-check

Cargo.lock

@@ -5243,17 +5243,6 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
-[[package]]
-name = "io-uring"
-version = "0.7.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9080b15e63775b9a2ac7dca720f7050a8b955e092ea0f6020a4a80f69998cdc0"
-dependencies = [
- "bitflags 2.13.0",
- "cfg-if",
- "libc",
-]
-
 [[package]]
 name = "ipconfig"
 version = "0.3.4"
@@ -11467,13 +11456,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
 dependencies = [
  "bytes",
- "io-uring",
  "libc",
  "mio",
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "slab",
  "socket2",
  "tokio-macros",
  "windows-sys 0.61.2",

crates/ecstore/Cargo.toml

@@ -171,7 +171,3 @@ harness = false
 
 [lib]
 doctest = false
-
-# io-uring is Linux-only. Scope the feature to Linux targets.
-[target.'cfg(target_os = "linux")'.dependencies]
-tokio = { workspace = true, features = ["io-uring"] }

crates/io-core/Cargo.toml

@@ -34,13 +34,6 @@ tokio = { workspace = true, features = ["io-util", "fs", "rt", "sync"] }
 memmap2 = { workspace = true }
 rustfs-io-metrics = { workspace = true }
 
-# Enable tokio's io_uring-based runtime backend on Linux.
-# Note: this is a tokio runtime feature, not application-level io_uring usage.
-# See the Tokio 1.52.0 release notes and tokio-rs/tokio#7907 for the upstream
-# runtime feature context.
-[target.'cfg(target_os = "linux")'.dependencies]
-tokio = { workspace = true, features = ["io-uring"] }
-
 [dev-dependencies]
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
 

crates/kms/Cargo.toml

@@ -70,7 +70,3 @@ temp-env = { workspace = true }
 
 [features]
 default = []
-
-# io-uring is Linux-only. Scope the feature to Linux targets.
-[target.'cfg(target_os = "linux")'.dependencies]
-tokio = { workspace = true, features = ["io-uring"] }

crates/protocols/Cargo.toml

@@ -136,7 +136,3 @@ tokio = { workspace = true, features = ["test-util", "macros", "rt"] }
 [package.metadata.docs.rs]
 all-features = true
 rustdoc-args = ["--cfg", "docsrs"]
-
-# io-uring is Linux-only. Scope the feature to Linux targets.
-[target.'cfg(target_os = "linux")'.dependencies]
-tokio = { workspace = true, features = ["io-uring"] }

crates/scanner/Cargo.toml

@@ -62,7 +62,3 @@ tokio = { workspace = true, features = ["test-util"] }
 
 [lib]
 doctest = false
-
-# io-uring is Linux-only. Scope the feature to Linux targets.
-[target.'cfg(target_os = "linux")'.dependencies]
-tokio = { workspace = true, features = ["io-uring"] }

crates/zip/Cargo.toml

@@ -54,7 +54,3 @@ tempfile = { workspace = true }
 
 [lints]
 workspace = true
-
-# io-uring is Linux-only. Scope the feature to Linux targets.
-[target.'cfg(target_os = "linux")'.dependencies]
-tokio = { workspace = true, features = ["io-uring"] }

rustfs/Cargo.toml

@@ -191,8 +191,6 @@ mimalloc = { workspace = true }
 
 [target.'cfg(target_os = "linux")'.dependencies]
 libsystemd.workspace = true
-# io-uring is Linux-only. Scope the feature to Linux targets.
-tokio = { workspace = true, features = ["io-uring"] }
 
 [target.'cfg(not(target_os = "windows"))'.dependencies]
 libmimalloc-sys = { version = "0.1.49", features = ["extended"] }

scripts/check_no_tokio_io_uring.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Guard: tokio's io-uring runtime backend must stay disabled.
+#
+# Restricted Linux environments (Docker default seccomp, gVisor, proot,
+# old kernels) reject io_uring_setup with EACCES/ENOSYS. With the global
+# `--cfg tokio_unstable` in .cargo/config.toml, a tokio "io-uring" feature
+# anywhere in the workspace silently switches every Linux build's file I/O
+# onto that backend and turns the rejection into DiskAccessDenied at
+# startup (backlog#890). Any future io_uring integration must go through
+# an application-level, runtime-probed backend (backlog#894), never the
+# tokio runtime feature — so only the tokio dependency line is banned
+# here; an explicit `io-uring` crate dependency is allowed.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="${CHECK_NO_TOKIO_IO_URING_ROOT:-$(cd "${SCRIPT_DIR}/.." && pwd)}"
+
+cd "$ROOT_DIR"
+
+status=0
+
+while IFS=: read -r file line content; do
+    printf '%s:%s: tokio must not enable the "io-uring" runtime feature: %s\n' \
+        "$file" "$line" "$content" >&2
+    status=1
+done < <(rg -n '^[[:space:]]*tokio[[:space:]]*=.*"io-uring"' --glob '**/Cargo.toml' . || true)
+
+exit "$status"