starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-12 16:02:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: describe nested namespaces in jobs and add optional userns rule

Browse Source
This commit is contained in:
Ruben Fiszel
2026-10-06 10:57:21 +02:00
parent 38fe9427ea
commit 94c3166a7f
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/deploy/nsjail-security-profiles/README.md
+5 -1
View File
@@ -28,6 +28,8 @@ sudo install -m 0644 windmill-nsjail.apparmor /etc/apparmor.d/windmill-nsjail
sudo apparmor_parser -r /etc/apparmor.d/windmill-nsjail
```
If the node's audit log shows AppArmor denying `userns_create` for the worker, uncomment the `userns,` rule in the profile (it needs AppArmor 4.0 or later, older parsers reject it) and reload it.
A pod that references a profile missing from its node fails to start, so node groups that autoscale need these steps in their bootstrap or in a DaemonSet. On nodes without AppArmor, remove the `appArmorProfile` block from the pod settings.
## Using the profiles with Docker
@@ -57,7 +59,9 @@ docker run \
## What the profiles give up
Jobs inherit the seccomp filter, so job code can also call `clone` with namespace flags and `mount`, which the runtime default denies to a container without `SYS_ADMIN`. The AppArmor profile no longer denies mounts, so its path rules on `/proc` and `/sys` do not hold against a process that has the capability to mount: with `kubernetes-sys-admin.yaml` that is the worker, never a job. Both remain far narrower than `Unconfined` or `privileged: true`.
Jobs inherit the seccomp filter, so job code can also call `clone` with namespace flags and `mount`, which the runtime default denies to a container without `SYS_ADMIN`. Where the kernel allows unprivileged user namespaces, a job can therefore create a nested user and mount namespace and mount filesystems inside it. This grants nothing outside that namespace, but it exposes more of the kernel to job code than the runtime default does.
The AppArmor profile no longer denies mounts, so its path rules on `/proc` and `/sys` do not hold against a process that can mount those filesystems elsewhere. Both profiles remain far narrower than `Unconfined` or `privileged: true`.
## Regenerating the seccomp profile
examples/deploy/nsjail-security-profiles/windmill-nsjail.apparmor
+4
View File
@@ -14,6 +14,10 @@ profile windmill-nsjail flags=(attach_disconnected,mediate_deleted) {
umount,
pivot_root,
# Needed where AppArmor mediates user namespace creation for this profile.
# AppArmor parsers older than 4.0 reject the rule, hence commented out.
# userns,
signal (receive) peer=unconfined,
signal (receive) peer=runc,
signal (receive) peer=crun,