diff --git a/backend/windmill-worker/nsjail/run.docker.config.proto b/backend/windmill-worker/nsjail/run.docker.config.proto
index a2da459fbe..5cc1e4ca03 100644
--- a/backend/windmill-worker/nsjail/run.docker.config.proto
+++ b/backend/windmill-worker/nsjail/run.docker.config.proto
@@ -77,6 +77,13 @@ mount {
     is_bind: true
 }
 
+mount {
+    dst: "/dev/shm"
+    fstype: "tmpfs"
+    rw: true
+    is_bind: false
+}
+
 # Host DNS config layered over the image's /etc so name resolution works on the
 # job's network (mandatory:false: some minimal images have no /etc files to shadow).
 mount {