From 6b31a6dee5f448f564df15ee6b4c5d87f87374fd Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 21 Feb 2025 17:06:10 +0100
Subject: [PATCH] fix ansible for nsjail

---
 backend/windmill-worker/nsjail/run.ansible.config.proto | 8 ++++++++
 backend/windmill-worker/src/ansible_executor.rs         | 3 ++-
 docker/DockerfileNsjail                                 | 4 +---
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/backend/windmill-worker/nsjail/run.ansible.config.proto b/backend/windmill-worker/nsjail/run.ansible.config.proto
index 6b03032238..65a8ea7006 100644
--- a/backend/windmill-worker/nsjail/run.ansible.config.proto
+++ b/backend/windmill-worker/nsjail/run.ansible.config.proto
@@ -16,6 +16,7 @@ clone_newuser: {CLONE_NEWUSER}
 
 keep_caps: false
 keep_env: true
+mount_proc: true
 
 mount {
     src: "/bin"
@@ -132,6 +133,13 @@ mount {
     is_bind: true
 }
 
+mount {
+    src: "{PY_INSTALL_DIR}"
+    dst: "{PY_INSTALL_DIR}"
+    is_bind: true
+}
+
+
 {SHARED_MOUNT}
 
 {SHARED_DEPENDENCIES}
diff --git a/backend/windmill-worker/src/ansible_executor.rs b/backend/windmill-worker/src/ansible_executor.rs
index b8a57ded16..a1b03acf1e 100644
--- a/backend/windmill-worker/src/ansible_executor.rs
+++ b/backend/windmill-worker/src/ansible_executor.rs
@@ -26,7 +26,7 @@ use crate::{
     handle_child::handle_child,
     python_executor::{create_dependencies_dir, handle_python_reqs, uv_pip_compile, PyVersion},
     AuthedClientBackgroundTask, DISABLE_NSJAIL, DISABLE_NUSER, HOME_ENV, NSJAIL_PATH, PATH_ENV,
-    PROXY_ENVS, TZ_ENV,
+    PROXY_ENVS, PY_INSTALL_DIR, TZ_ENV,
 };
 
 lazy_static::lazy_static! {
@@ -333,6 +333,7 @@ mount {{
             job_dir,
             "run.config.proto",
             &NSJAIL_CONFIG_RUN_ANSIBLE_CONTENT
+                .replace("{PY_INSTALL_DIR}", PY_INSTALL_DIR)
                 .replace("{JOB_DIR}", job_dir)
                 .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
                 .replace("{SHARED_MOUNT}", shared_mount)
diff --git a/docker/DockerfileNsjail b/docker/DockerfileNsjail
index bab8f00144..ca1c71b706 100644
--- a/docker/DockerfileNsjail
+++ b/docker/DockerfileNsjail
@@ -1,6 +1,4 @@
-ARG DEBIAN_IMAGE=debian:bookworm-slim
-
-FROM ${DEBIAN_IMAGE} as nsjail
+FROM debian:bookworm-slim AS nsjail
 
 WORKDIR /nsjail