starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-28 00:02:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: worker group toggle to keep the worker's proxy out of jobs (#11958)

Browse Source 
* feat: worker group setting to strip env vars from the nsjail sandbox

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: apply the nsjail env denylist to profile envar directives too

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor: drop the nsjail env denylist spawn hook

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: replace the nsjail env denylist with a worker group toggle for the job proxy

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: honor the job proxy toggle in duckdb and drop the env var fallback

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: pre-install duckdb extensions with the proxy when jobs run without it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: update ee-repo-ref to 5cfc0dc6760ea7f631fc98ea1edd39adfc55bf11

This commit updates the EE repository reference after PR #914 was merged in windmill-ee-private.

Previous ee-repo-ref: 8394f2d1b67765ba854205836185342e62df841e

New ee-repo-ref: 5cfc0dc6760ea7f631fc98ea1edd39adfc55bf11

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
This commit is contained in:
Ruben Fiszel
2026-10-23 00:47:12 +02:00
committed by GitHub
co-authored by Claude Opus 5.5 windmill-internal-app[bot]
parent 0dd131b380
commit 8a0318a28f
14 changed files with 141 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/lib/components/WorkerGroup.svelte
+27
View File
@@ -105,6 +105,7 @@
periodic_script_interval_seconds?: number
env_vars_static?: Map<string, string>
env_vars_allowlist?: string[]
disable_job_proxy?: boolean
additional_python_paths?: string[]
pip_local_dependencies?: string[]
min_alive_workers_alert_threshold?: number
@@ -212,6 +213,7 @@
init_bash?: string
env_vars_static?: Map<string, string>
env_vars_allowlist?: string[]
disable_job_proxy?: boolean
additional_python_paths?: string[]
pip_local_dependencies?: string[]
min_alive_workers_alert_threshold?: number
@@ -327,6 +329,7 @@
'priority_tags',
'additional_python_paths',
'pip_local_dependencies',
'disable_job_proxy',
'object_store_cache_config',
'serves_dev_workspaces'
] as const
@@ -909,6 +912,30 @@
disabled={!canEditConfig}
/>
</Label>
<div class="mt-8"></div>
<Label label="Worker proxy">
{#snippet header()}
<Tooltip>
{#snippet text()}
Whether jobs get the worker's HTTP_PROXY, HTTPS_PROXY and NO_PROXY. Dependency
installs always go through the proxy, whatever this is set to. Removing the variables
does not stop a job from reaching the proxy if it knows its address. Workers pick the
change up without restarting.
{/snippet}
</Tooltip>
{/snippet}
<Toggle
size="sm"
options={{ right: "Pass the worker's proxy to jobs" }}
checked={nconfig?.disable_job_proxy !== true}
on:change={(ev) => {
if (nconfig !== undefined) {
nconfig.disable_job_proxy = ev.detail ? undefined : true
}
}}
disabled={!canEditConfig}
/>
</Label>
{/if}
<div class="mt-8"></div>