starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-19 00:02:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: add DISABLE_NUSER for older kernels

Browse Source
This commit is contained in:
Ruben Fiszel
2022-06-12 13:30:40 +02:00
parent 5afcb2b274
commit cce46f9440
5 changed files with 60 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3
View File
@@ -107,6 +107,9 @@ Windmill is <b>fully open-sourced</b>:
`docker compose up` with the following docker-compose is sufficient:
<https://github.com/windmill-labs/windmill/blob/main/docker-compose.yml>
For older kernels < 4.18, set DISABLE_NUSER to true otherwise nsjail will not be
able to launch the isolated scripts.
The default super-admin user is: admin@windmill.dev / changeme
From there, you can create other users (do not forget to change the password!)
backend/src/lib.rs
+2
View File
@@ -265,6 +265,7 @@ pub async fn run_workers(
num_workers: i32,
sleep_queue: u64,
base_url: String,
disable_nuser: bool,
tx: tokio::sync::broadcast::Sender<()>,
) -> anyhow::Result<()> {
let instance_name = rd_string(5);
@@ -304,6 +305,7 @@ pub async fn run_workers(
&ip,
sleep_queue,
&base_url,
disable_nuser,
tx,
)
.await
backend/src/main.rs
+8
View File
@@ -66,7 +66,14 @@ async fn main() -> anyhow::Result<()> {
.ok()
.and_then(|x| x.parse::<u64>().ok())
.unwrap_or(windmill::DEFAULT_SLEEP_QUEUE);
let disable_nuser = std::env::var("DISABLE_NUSER")
.ok()
.and_then(|x| x.parse::<bool>().ok())
.unwrap_or(false);
tracing::info!(
"DISABLE_NUSER: {disable_nuser}, BASE_URL: {base_url}, SLEEP_QUEUE: {sleep_queue}, NUM_WORKERS: {num_workers}, TIMEOUT: {timeout}"
);
windmill::run_workers(
db.clone(),
addr,
@@ -74,6 +81,7 @@ async fn main() -> anyhow::Result<()> {
num_workers,
sleep_queue,
base_url,
disable_nuser,
tx.clone(),
)
.await?;
backend/src/worker.rs
+46 -23
View File
@@ -64,6 +64,7 @@ pub async fn run_worker(
ip: &str,
sleep_queue: u64,
base_url: &str,
disable_nuser: bool,
tx: tokio::sync::broadcast::Sender<()>,
) {
let worker_dir = format!("{TMP_DIR}/{worker_name}");
@@ -106,10 +107,17 @@ pub async fn run_worker(
tracing::info!(worker = %worker_name, id = %job.id, "Fetched job");
let job2 = job.clone();
if let Some(err) =
handle_queued_job(job, db, timeout, &worker_name, &worker_dir, base_url)
.await
.err()
if let Some(err) = handle_queued_job(
job,
db,
timeout,
&worker_name,
&worker_dir,
base_url,
disable_nuser,
)
.await
.err()
{
let err_string = err.to_string().clone();
let _ = add_completed_job_error(
@@ -161,6 +169,7 @@ async fn handle_queued_job(
worker_name: &str,
worker_dir: &str,
base_url: &str,
disable_nuser: bool,
) -> crate::error::Result<()> {
let job_id = job.id;
let w_id = &job.workspace_id.clone();
@@ -197,6 +206,7 @@ async fn handle_queued_job(
&mut logs,
&mut last_line,
base_url,
disable_nuser,
)
.await;
@@ -272,6 +282,7 @@ async fn handle_job(
mut logs: &mut String,
mut last_line: &mut String,
base_url: &str,
disable_nuser: bool,
) -> Result<JobResult, Error> {
tracing::info!(
worker = %worker_name,
@@ -389,9 +400,13 @@ async fn handle_job(
.await?;
let _ = write_file(&job_dir, "requirements.txt", &requirements).await?;
let mut args = vec!["--config", "download.config.proto"];
if disable_nuser {
args.insert(0, "--disable_clone_newuser")
}
let child = Command::new("nsjail")
.current_dir(&job_dir)
.args(vec!["--config", "download.config.proto"])
.args(args)
.stdout(Stdio::piped())
.stderr(Stdio::piped())
.spawn()?;
@@ -488,17 +503,21 @@ print(res_json)
)
.await?;
let mut args = vec![
"--config",
"run.config.proto",
"--",
"/usr/local/bin/python3",
"-u",
"/tmp/main.py",
];
if disable_nuser {
args.insert(0, "--disable_clone_newuser")
}
let child = Command::new("nsjail")
.current_dir(&job_dir)
.envs(reserved_variables)
.args(vec![
"--config",
"run.config.proto",
"--",
"/usr/local/bin/python3",
"-u",
"/tmp/main.py",
])
.args(args)
.stdout(Stdio::piped())
.stderr(Stdio::piped())
.spawn()?;
@@ -592,19 +611,23 @@ run();
)
.await?;
let mut args = vec![
"--config",
"run.config.proto",
"--",
"/usr/bin/deno",
"run",
"--v8-flags=--max-heap-size=2048",
"-A",
"/tmp/main.ts",
];
if disable_nuser {
args.insert(0, "--disable_clone_newuser")
}
let child = Command::new("nsjail")
.current_dir(&job_dir)
.envs(reserved_variables)
.args(vec![
"--config",
"run.config.proto",
"--",
"/usr/bin/deno",
"run",
"--v8-flags=--max-heap-size=2048",
"-A",
"/tmp/main.ts",
])
.args(args)
.stdout(Stdio::piped())
.stderr(Stdio::piped())
.spawn()?;
docker-compose.yml
+1
View File
@@ -34,6 +34,7 @@ services:
- RUST_BACKTRACE=1
- GITHUB_OAUTH_CLIENT_ID=${GITHUB_OAUTH_CLIENT_ID}
- GITHUB_OAUTH_CLIENT_SECRET=${GITHUB_OAUTH_CLIENT_SECRET}
- DISABLE_NUSER=false
depends_on:
db: