fix(debugger): add nsjail config for proper sandbox mounts

The nsjail debugger mode was failing with "chdir('/tmp'): No such file
or directory" because without a config file, nsjail uses minimal mounts
that don't include /tmp or other necessary directories.

Added nsjail.debug.config.proto with proper mounts:
- /bin, /lib, /lib64, /usr, /etc (system directories)
- /tmp as tmpfs (for script execution)
- /dev/null, /dev/random, /dev/urandom (device nodes)
- /root as tmpfs (for bun cache)

Also updated:
- entrypoint-extra.sh: Pass --nsjail-config when ENABLE_NSJAIL=true
- DockerfileExtra: Copy nsjail config, update ports to 3003

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

debugger/nsjail.debug.config.proto

@@ -0,0 +1,96 @@
+name: "debugger sandbox"
+
+mode: ONCE
+hostname: "debugger"
+log_level: ERROR
+
+disable_rl: true
+
+mount_proc: true
+
+clone_newnet: false
+clone_newuser: true
+clone_newcgroup: false
+
+skip_setsid: true
+keep_caps: false
+keep_env: true
+
+# System directories (read-only)
+mount {
+    src: "/bin"
+    dst: "/bin"
+    is_bind: true
+}
+
+mount {
+    src: "/lib"
+    dst: "/lib"
+    is_bind: true
+}
+
+mount {
+    src: "/lib64"
+    dst: "/lib64"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "/usr"
+    dst: "/usr"
+    is_bind: true
+}
+
+mount {
+    src: "/etc"
+    dst: "/etc"
+    is_bind: true
+}
+
+mount {
+    src: "/sys/fs"
+    dst: "/sys/fs"
+    is_bind: true
+    mandatory: false
+}
+
+# Temporary filesystem for /tmp (writable)
+mount {
+    dst: "/tmp"
+    fstype: "tmpfs"
+    rw: true
+    options: "size=500000000"
+}
+
+# Device nodes
+mount {
+    src: "/dev/null"
+    dst: "/dev/null"
+    is_bind: true
+    rw: true
+}
+
+mount {
+    src: "/dev/random"
+    dst: "/dev/random"
+    is_bind: true
+}
+
+mount {
+    src: "/dev/urandom"
+    dst: "/dev/urandom"
+    is_bind: true
+}
+
+# Home directory (for bun cache etc)
+mount {
+    dst: "/root"
+    fstype: "tmpfs"
+    rw: true
+}
+
+iface_no_lo: true
+
+envar: "HOME=/root"
+envar: "TMPDIR=/tmp"

docker/DockerfileExtra

@@ -3,7 +3,7 @@
 # This image extends windmill-slim with three optional Windmill services:
 # - LSP (Language Server Protocol) - Port 3001
 # - Multiplayer (y-websocket) - Port 3002
-# - Debugger (DAP WebSocket) - Port 5679
+# - Debugger (DAP WebSocket) - Port 3003
 #
 # Each service can be enabled/disabled via environment variables:
 # - ENABLE_LSP=true (default: true)
@@ -14,7 +14,7 @@
 #   docker build -f docker/DockerfileExtra -t windmill-extra .
 #
 # Run:
-#   docker run -p 3001:3001 -p 3002:3002 -p 5679:5679 windmill-extra
+#   docker run -p 3001:3001 -p 3002:3002 -p 3003:3003 windmill-extra
 
 # ============================================================================
 # Stage 1: Get nsjail from the nsjail image
@@ -106,6 +106,7 @@ WORKDIR /debugger
 COPY debugger/dap_debug_service.ts .
 COPY debugger/dap_websocket_server_bun.ts .
 COPY debugger/dap_websocket_server.py .
+COPY debugger/nsjail.debug.config.proto .
 
 # Install Python debugger dependencies using uv
 RUN uv pip install --system --break-system-packages websockets debugpy
@@ -139,7 +140,7 @@ RUN chmod -R a+rX /usr/local && \
     chmod -R a+rX /debugger
 
 # Expose all service ports
-EXPOSE 3001 3002 5679
+EXPOSE 3001 3002 3003
 
 # Environment variables for service control
 ENV ENABLE_LSP=true
@@ -160,6 +161,5 @@ ENV DEBUGGER_PORT=3003
 
 # Windmill base URL for debugger token verification
 ENV WINDMILL_BASE_URL=""
-ENV BASE_INTERNAL_URL=""
 
 ENTRYPOINT ["/entrypoint.sh"]

docker/entrypoint-extra.sh

@@ -73,7 +73,7 @@ if [ "${ENABLE_DEBUGGER:-true}" = "true" ]; then
 
     # Enable nsjail if requested
     if [ "${ENABLE_NSJAIL:-false}" = "true" ]; then
-        DEBUGGER_ARGS="$DEBUGGER_ARGS --nsjail"
+        DEBUGGER_ARGS="$DEBUGGER_ARGS --nsjail --nsjail-config /debugger/nsjail.debug.config.proto"
     fi
 
     bun run dap_debug_service.ts $DEBUGGER_ARGS &