From 1b37d8a2ab771dcc8d9be3dc737081551bc08500 Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Fri, 19 Dec 2025 14:36:51 -0500
Subject: [PATCH] fix: do not use unshare for init scripts (#7418)

---
 backend/windmill-worker/src/bash_executor.rs | 36 +++++++++++++-------
 backend/windmill-worker/src/pwsh_executor.rs | 30 ++++++++++------
 2 files changed, 43 insertions(+), 23 deletions(-)

diff --git a/backend/windmill-worker/src/bash_executor.rs b/backend/windmill-worker/src/bash_executor.rs
index 640f3c9fae..81cf920082 100644
--- a/backend/windmill-worker/src/bash_executor.rs
+++ b/backend/windmill-worker/src/bash_executor.rs
@@ -159,15 +159,18 @@ exit $exit_status
     let _ = write_file(job_dir, "result.out", "")?;
     let _ = write_file(job_dir, "result2.out", "")?;
 
-    let nsjail = !*DISABLE_NSJAIL
-        && job
-            .runnable_path
-            .as_ref()
-            .map(|x| {
-                !x.starts_with(INIT_SCRIPT_PATH_PREFIX)
-                    && !x.starts_with(PERIODIC_SCRIPT_PATH_PREFIX)
-            })
-            .unwrap_or(true);
+    // Check if this is a regular job (not init or periodic script)
+    // Init/periodic scripts need full system access without isolation
+    let is_regular_job = job
+        .runnable_path
+        .as_ref()
+        .map(|x| {
+            !x.starts_with(INIT_SCRIPT_PATH_PREFIX)
+                && !x.starts_with(PERIODIC_SCRIPT_PATH_PREFIX)
+        })
+        .unwrap_or(true);
+
+    let nsjail = !*DISABLE_NSJAIL && is_regular_job;
     let child = if nsjail {
         let _ = write_file(
             job_dir,
@@ -200,10 +203,17 @@ exit $exit_status
     } else {
         let mut cmd_args = vec!["wrapper.sh"];
         cmd_args.extend(&args);
-        let mut bash_cmd = build_command_with_isolation(
-            BIN_BASH.as_str(),
-            &cmd_args.iter().map(|s| s.as_ref()).collect::<Vec<&str>>(),
-        );
+        // Only apply unshare isolation for regular jobs, not init/periodic scripts
+        let mut bash_cmd = if is_regular_job {
+            build_command_with_isolation(
+                BIN_BASH.as_str(),
+                &cmd_args.iter().map(|s| s.as_ref()).collect::<Vec<&str>>(),
+            )
+        } else {
+            let mut cmd = Command::new(BIN_BASH.as_str());
+            cmd.args(&cmd_args);
+            cmd
+        };
         bash_cmd
             .current_dir(job_dir)
             .env_clear()
diff --git a/backend/windmill-worker/src/pwsh_executor.rs b/backend/windmill-worker/src/pwsh_executor.rs
index b2a81234a3..9b2a19fec5 100644
--- a/backend/windmill-worker/src/pwsh_executor.rs
+++ b/backend/windmill-worker/src/pwsh_executor.rs
@@ -487,15 +487,18 @@ $env:PSModulePath = \"{};$PSModulePathBackup\"",
     let _ = write_file(job_dir, "result.out", "")?;
     let _ = write_file(job_dir, "result2.out", "")?;
 
-    let nsjail = !*DISABLE_NSJAIL
-        && job
-            .runnable_path
-            .as_ref()
-            .map(|x| {
-                !x.starts_with(INIT_SCRIPT_PATH_PREFIX)
-                    && !x.starts_with(PERIODIC_SCRIPT_PATH_PREFIX)
-            })
-            .unwrap_or(true);
+    // Check if this is a regular job (not init or periodic script)
+    // Init/periodic scripts need full system access without isolation
+    let is_regular_job = job
+        .runnable_path
+        .as_ref()
+        .map(|x| {
+            !x.starts_with(INIT_SCRIPT_PATH_PREFIX)
+                && !x.starts_with(PERIODIC_SCRIPT_PATH_PREFIX)
+        })
+        .unwrap_or(true);
+
+    let nsjail = !*DISABLE_NSJAIL && is_regular_job;
     let child = if nsjail {
         let _ = write_file(
             job_dir,
@@ -539,7 +542,14 @@ $env:PSModulePath = \"{};$PSModulePathBackup\"",
             cmd_args = vec![r".\wrapper.ps1"];
         }
 
-        let mut cmd = build_command_with_isolation(POWERSHELL_PATH.as_str(), &cmd_args);
+        // Only apply unshare isolation for regular jobs, not init/periodic scripts
+        let mut cmd = if is_regular_job {
+            build_command_with_isolation(POWERSHELL_PATH.as_str(), &cmd_args)
+        } else {
+            let mut c = Command::new(POWERSHELL_PATH.as_str());
+            c.args(&cmd_args);
+            c
+        };
 
         cmd.current_dir(job_dir)
             .env_clear()