docs: enable nsjail through the job isolation instance setting

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

examples/deploy/nsjail-security-profiles/README.md

@@ -42,10 +42,15 @@ docker run \
   --security-opt systempaths=unconfined \
   --security-opt seccomp=windmill-nsjail.seccomp.json \
   --security-opt apparmor=windmill-nsjail \
-  -e DISABLE_NSJAIL=false \
   ...
 ```
 
+## Enabling nsjail
+
+The profiles and pod settings only make nsjail able to run. To turn it on, set the **Job isolation** [instance setting](https://www.windmill.dev/docs/advanced/instance_settings) to **Nsjail**. It applies to every worker of the instance, so each of them needs settings under which nsjail can run.
+
+The `DISABLE_NSJAIL=false` environment variable is the fallback: it enables nsjail on the workers that carry it, whatever the instance setting says. Use it to sandbox only some worker groups.
+
 ## Which pod settings to use
 
 | | `kubernetes-user-namespaces.yaml` | `kubernetes-sys-admin.yaml` |

examples/deploy/nsjail-security-profiles/kubernetes-sys-admin.yaml

@@ -10,7 +10,7 @@ spec:
       image: ghcr.io/windmill-labs/windmill:main
       env:
         - { name: MODE, value: worker }
-        - { name: DISABLE_NSJAIL, value: "false" }
+        # nsjail is enabled by the "Job isolation" instance setting.
         - { name: DISABLE_NUSER, value: "true" }
       securityContext:
         runAsUser: 0

examples/deploy/nsjail-security-profiles/kubernetes-user-namespaces.yaml

@@ -11,7 +11,7 @@ spec:
       image: ghcr.io/windmill-labs/windmill:main
       env:
         - { name: MODE, value: worker }
-        - { name: DISABLE_NSJAIL, value: "false" }
+        # nsjail is enabled by the "Job isolation" instance setting.
         # DISABLE_NUSER stays unset: nsjail creates its own user namespace.
       securityContext:
         runAsUser: 1000