From 40d438fe47740657bb46128b3e177c7763c3a2b8 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Tue, 6 Oct 2026 13:13:58 +0200 Subject: [PATCH] docs: enable nsjail through the job isolation instance setting Co-Authored-By: Claude Opus 5.5 (1M context) --- examples/deploy/nsjail-security-profiles/README.md | 7 ++++++- .../nsjail-security-profiles/kubernetes-sys-admin.yaml | 2 +- .../kubernetes-user-namespaces.yaml | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/examples/deploy/nsjail-security-profiles/README.md b/examples/deploy/nsjail-security-profiles/README.md index a1ce8212c6..659ebbe98a 100644 --- a/examples/deploy/nsjail-security-profiles/README.md +++ b/examples/deploy/nsjail-security-profiles/README.md @@ -42,10 +42,15 @@ docker run \ --security-opt systempaths=unconfined \ --security-opt seccomp=windmill-nsjail.seccomp.json \ --security-opt apparmor=windmill-nsjail \ - -e DISABLE_NSJAIL=false \ ... ``` +## Enabling nsjail + +The profiles and pod settings only make nsjail able to run. To turn it on, set the **Job isolation** [instance setting](https://www.windmill.dev/docs/advanced/instance_settings) to **Nsjail**. It applies to every worker of the instance, so each of them needs settings under which nsjail can run. + +The `DISABLE_NSJAIL=false` environment variable is the fallback: it enables nsjail on the workers that carry it, whatever the instance setting says. Use it to sandbox only some worker groups. + ## Which pod settings to use | | `kubernetes-user-namespaces.yaml` | `kubernetes-sys-admin.yaml` | diff --git a/examples/deploy/nsjail-security-profiles/kubernetes-sys-admin.yaml b/examples/deploy/nsjail-security-profiles/kubernetes-sys-admin.yaml index b4b0640495..ee3387fa6d 100644 --- a/examples/deploy/nsjail-security-profiles/kubernetes-sys-admin.yaml +++ b/examples/deploy/nsjail-security-profiles/kubernetes-sys-admin.yaml @@ -10,7 +10,7 @@ spec: image: ghcr.io/windmill-labs/windmill:main env: - { name: MODE, value: worker } - - { name: DISABLE_NSJAIL, value: "false" } + # nsjail is enabled by the "Job isolation" instance setting. - { name: DISABLE_NUSER, value: "true" } securityContext: runAsUser: 0 diff --git a/examples/deploy/nsjail-security-profiles/kubernetes-user-namespaces.yaml b/examples/deploy/nsjail-security-profiles/kubernetes-user-namespaces.yaml index 57e4a8e786..76ae7c67c4 100644 --- a/examples/deploy/nsjail-security-profiles/kubernetes-user-namespaces.yaml +++ b/examples/deploy/nsjail-security-profiles/kubernetes-user-namespaces.yaml @@ -11,7 +11,7 @@ spec: image: ghcr.io/windmill-labs/windmill:main env: - { name: MODE, value: worker } - - { name: DISABLE_NSJAIL, value: "false" } + # nsjail is enabled by the "Job isolation" instance setting. # DISABLE_NUSER stays unset: nsjail creates its own user namespace. securityContext: runAsUser: 1000