fix ansible for nsjail

backend/windmill-worker/nsjail/run.ansible.config.proto

@@ -16,6 +16,7 @@ clone_newuser: {CLONE_NEWUSER}
 
 keep_caps: false
 keep_env: true
+mount_proc: true
 
 mount {
     src: "/bin"
@@ -132,6 +133,13 @@ mount {
     is_bind: true
 }
 
+mount {
+    src: "{PY_INSTALL_DIR}"
+    dst: "{PY_INSTALL_DIR}"
+    is_bind: true
+}
+
+
 {SHARED_MOUNT}
 
 {SHARED_DEPENDENCIES}

backend/windmill-worker/src/ansible_executor.rs

@@ -26,7 +26,7 @@ use crate::{
     handle_child::handle_child,
     python_executor::{create_dependencies_dir, handle_python_reqs, uv_pip_compile, PyVersion},
     AuthedClientBackgroundTask, DISABLE_NSJAIL, DISABLE_NUSER, HOME_ENV, NSJAIL_PATH, PATH_ENV,
-    PROXY_ENVS, TZ_ENV,
+    PROXY_ENVS, PY_INSTALL_DIR, TZ_ENV,
 };
 
 lazy_static::lazy_static! {
@@ -333,6 +333,7 @@ mount {{
             job_dir,
             "run.config.proto",
             &NSJAIL_CONFIG_RUN_ANSIBLE_CONTENT
+                .replace("{PY_INSTALL_DIR}", PY_INSTALL_DIR)
                 .replace("{JOB_DIR}", job_dir)
                 .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
                 .replace("{SHARED_MOUNT}", shared_mount)

docker/DockerfileNsjail

@@ -1,6 +1,4 @@
-ARG DEBIAN_IMAGE=debian:bookworm-slim
-
-FROM ${DEBIAN_IMAGE} as nsjail
+FROM debian:bookworm-slim AS nsjail
 
 WORKDIR /nsjail