From 2caee41fdfe1e69010a1f4544d45aaa5db49f590 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Tue, 21 Jul 2026 17:49:29 +0200 Subject: [PATCH] fix(worker): mount /dev/shm as tmpfs in the Docker v2 nsjail sandbox (#10240) The Docker v2 nsjail profile provided /dev/null, /dev/zero, /dev/random, and /dev/urandom but omitted /dev/shm, since generate_rootfs_mounts() skips the image's own /dev in favor of the profile's device nodes. Any program needing POSIX shared memory (Ansible/Python multiprocessing, Chromium) failed with "No such file or directory: /dev/shm". Add a /dev/shm tmpfs mount, matching run.ansible.config.proto and run.python3.config.proto. Fixes WIN-2216 Co-authored-by: Claude Opus 4.8 (1M context) --- backend/windmill-worker/nsjail/run.docker.config.proto | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/backend/windmill-worker/nsjail/run.docker.config.proto b/backend/windmill-worker/nsjail/run.docker.config.proto index a2da459fbe..5cc1e4ca03 100644 --- a/backend/windmill-worker/nsjail/run.docker.config.proto +++ b/backend/windmill-worker/nsjail/run.docker.config.proto @@ -77,6 +77,13 @@ mount { is_bind: true } +mount { + dst: "/dev/shm" + fstype: "tmpfs" + rw: true + is_bind: false +} + # Host DNS config layered over the image's /etc so name resolution works on the # job's network (mandatory:false: some minimal images have no /etc files to shadow). mount {