disable nsjail by default

backend/src/main.rs

@@ -82,7 +82,7 @@ async fn main() -> anyhow::Result<()> {
                 let disable_nsjail = std::env::var("DISABLE_NSJAIL")
                     .ok()
                     .and_then(|x| x.parse::<bool>().ok())
-                    .unwrap_or(false);
+                    .unwrap_or(true);
                 let keep_job_dir = std::env::var("KEEP_JOB_DIR")
                     .ok()
                     .and_then(|x| x.parse::<bool>().ok())
@@ -184,6 +184,13 @@ pub async fn run_workers(
         panic!("License key is required ONLY for the enterprise edition");
     }
 
+    #[cfg(not(feature = "enterprise"))]
+    if !worker_config.disable_nsjail {
+        tracing::warn!(
+            "NSJAIL to sandbox process in untrusted environments is an enterprise feature but allowed to be used for testing purposes"
+        );
+    }
+
     let instance_name = rd_string(5);
     let monitor = tokio_metrics::TaskMonitor::new();
 

backend/windmill-worker/src/main.rs

@@ -76,7 +76,7 @@ async fn main() -> anyhow::Result<()> {
         let disable_nsjail = std::env::var("DISABLE_NSJAIL")
             .ok()
             .and_then(|x| x.parse::<bool>().ok())
-            .unwrap_or(false);
+            .unwrap_or(true);
         let keep_job_dir = std::env::var("KEEP_JOB_DIR")
             .ok()
             .and_then(|x| x.parse::<bool>().ok())

docker-compose.yml

@@ -22,7 +22,8 @@ services:
 
   windmill:
     image: ghcr.io/windmill-labs/windmill:main
-    privileged: true
+    # Set privileged to true if enabling nsjail
+    privileged: false
     restart: unless-stopped
     ports:
       - 8000:8000
@@ -32,13 +33,15 @@ services:
       - BASE_INTERNAL_URL=http://localhost:8000
       - RUST_LOG=info
       - NUM_WORKERS=3
-      - DISABLE_NUSER=false
-      - DISABLE_NSJAIL=false
-      - KEEP_JOB_DIR=true
+      - KEEP_JOB_DIR=false
       - DENO_PATH=/usr/bin/deno
       - PYTHON_PATH=/usr/local/bin/python3
-      - NSJAIL_PATH=nsjail
       - METRICS_ADDR=false
+      # for ease of use, nsjail which provide isolation in untrusted environment is disabled by default. 
+      # To enable it, uncomment the following line and set the container as privileged.     
+      # - DISABLE_NSJAIL=false
+      # - DISABLE_NUSER=fals
+      # - NSJAIL_PATH=nsjail
     depends_on:
       db:
         condition: service_healthy