diff --git a/README.md b/README.md
index 7cee3d8c14..281d6003b7 100644
--- a/README.md
+++ b/README.md
@@ -107,6 +107,9 @@ Windmill is <b>fully open-sourced</b>:
 `docker compose up` with the following docker-compose is sufficient:
 <https://github.com/windmill-labs/windmill/blob/main/docker-compose.yml>
 
+For older kernels < 4.18, set DISABLE_NUSER to true otherwise nsjail will not be
+able to launch the isolated scripts.
+
 The default super-admin user is: admin@windmill.dev / changeme
 
 From there, you can create other users (do not forget to change the password!)
diff --git a/backend/src/lib.rs b/backend/src/lib.rs
index 3030eb2e01..5e5a7b31a9 100644
--- a/backend/src/lib.rs
+++ b/backend/src/lib.rs
@@ -265,6 +265,7 @@ pub async fn run_workers(
     num_workers: i32,
     sleep_queue: u64,
     base_url: String,
+    disable_nuser: bool,
     tx: tokio::sync::broadcast::Sender<()>,
 ) -> anyhow::Result<()> {
     let instance_name = rd_string(5);
@@ -304,6 +305,7 @@ pub async fn run_workers(
                 &ip,
                 sleep_queue,
                 &base_url,
+                disable_nuser,
                 tx,
             )
             .await
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 52fa2727d6..cfbc60adf6 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -66,7 +66,14 @@ async fn main() -> anyhow::Result<()> {
                     .ok()
                     .and_then(|x| x.parse::<u64>().ok())
                     .unwrap_or(windmill::DEFAULT_SLEEP_QUEUE);
+                let disable_nuser = std::env::var("DISABLE_NUSER")
+                    .ok()
+                    .and_then(|x| x.parse::<bool>().ok())
+                    .unwrap_or(false);
 
+                tracing::info!(
+                    "DISABLE_NUSER: {disable_nuser}, BASE_URL: {base_url}, SLEEP_QUEUE: {sleep_queue}, NUM_WORKERS: {num_workers}, TIMEOUT: {timeout}"
+                );
                 windmill::run_workers(
                     db.clone(),
                     addr,
@@ -74,6 +81,7 @@ async fn main() -> anyhow::Result<()> {
                     num_workers,
                     sleep_queue,
                     base_url,
+                    disable_nuser,
                     tx.clone(),
                 )
                 .await?;
diff --git a/backend/src/worker.rs b/backend/src/worker.rs
index 0d265c71c2..970a369713 100644
--- a/backend/src/worker.rs
+++ b/backend/src/worker.rs
@@ -64,6 +64,7 @@ pub async fn run_worker(
     ip: &str,
     sleep_queue: u64,
     base_url: &str,
+    disable_nuser: bool,
     tx: tokio::sync::broadcast::Sender<()>,
 ) {
     let worker_dir = format!("{TMP_DIR}/{worker_name}");
@@ -106,10 +107,17 @@ pub async fn run_worker(
 
                 tracing::info!(worker = %worker_name, id = %job.id, "Fetched job");
                 let job2 = job.clone();
-                if let Some(err) =
-                    handle_queued_job(job, db, timeout, &worker_name, &worker_dir, base_url)
-                        .await
-                        .err()
+                if let Some(err) = handle_queued_job(
+                    job,
+                    db,
+                    timeout,
+                    &worker_name,
+                    &worker_dir,
+                    base_url,
+                    disable_nuser,
+                )
+                .await
+                .err()
                 {
                     let err_string = err.to_string().clone();
                     let _ = add_completed_job_error(
@@ -161,6 +169,7 @@ async fn handle_queued_job(
     worker_name: &str,
     worker_dir: &str,
     base_url: &str,
+    disable_nuser: bool,
 ) -> crate::error::Result<()> {
     let job_id = job.id;
     let w_id = &job.workspace_id.clone();
@@ -197,6 +206,7 @@ async fn handle_queued_job(
                 &mut logs,
                 &mut last_line,
                 base_url,
+                disable_nuser,
             )
             .await;
 
@@ -272,6 +282,7 @@ async fn handle_job(
     mut logs: &mut String,
     mut last_line: &mut String,
     base_url: &str,
+    disable_nuser: bool,
 ) -> Result<JobResult, Error> {
     tracing::info!(
         worker = %worker_name,
@@ -389,9 +400,13 @@ async fn handle_job(
                 .await?;
                 let _ = write_file(&job_dir, "requirements.txt", &requirements).await?;
 
+                let mut args = vec!["--config", "download.config.proto"];
+                if disable_nuser {
+                    args.insert(0, "--disable_clone_newuser")
+                }
                 let child = Command::new("nsjail")
                     .current_dir(&job_dir)
-                    .args(vec!["--config", "download.config.proto"])
+                    .args(args)
                     .stdout(Stdio::piped())
                     .stderr(Stdio::piped())
                     .spawn()?;
@@ -488,17 +503,21 @@ print(res_json)
                     )
                     .await?;
 
+                    let mut args = vec![
+                        "--config",
+                        "run.config.proto",
+                        "--",
+                        "/usr/local/bin/python3",
+                        "-u",
+                        "/tmp/main.py",
+                    ];
+                    if disable_nuser {
+                        args.insert(0, "--disable_clone_newuser")
+                    }
                     let child = Command::new("nsjail")
                         .current_dir(&job_dir)
                         .envs(reserved_variables)
-                        .args(vec![
-                            "--config",
-                            "run.config.proto",
-                            "--",
-                            "/usr/local/bin/python3",
-                            "-u",
-                            "/tmp/main.py",
-                        ])
+                        .args(args)
                         .stdout(Stdio::piped())
                         .stderr(Stdio::piped())
                         .spawn()?;
@@ -592,19 +611,23 @@ run();
                 )
                 .await?;
 
+                let mut args = vec![
+                    "--config",
+                    "run.config.proto",
+                    "--",
+                    "/usr/bin/deno",
+                    "run",
+                    "--v8-flags=--max-heap-size=2048",
+                    "-A",
+                    "/tmp/main.ts",
+                ];
+                if disable_nuser {
+                    args.insert(0, "--disable_clone_newuser")
+                }
                 let child = Command::new("nsjail")
                     .current_dir(&job_dir)
                     .envs(reserved_variables)
-                    .args(vec![
-                        "--config",
-                        "run.config.proto",
-                        "--",
-                        "/usr/bin/deno",
-                        "run",
-                        "--v8-flags=--max-heap-size=2048",
-                        "-A",
-                        "/tmp/main.ts",
-                    ])
+                    .args(args)
                     .stdout(Stdio::piped())
                     .stderr(Stdio::piped())
                     .spawn()?;
diff --git a/docker-compose.yml b/docker-compose.yml
index 7ce8e051a9..bf5da58889 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -34,6 +34,7 @@ services:
       - RUST_BACKTRACE=1
       - GITHUB_OAUTH_CLIENT_ID=${GITHUB_OAUTH_CLIENT_ID}
       - GITHUB_OAUTH_CLIENT_SECRET=${GITHUB_OAUTH_CLIENT_SECRET}
+      - DISABLE_NUSER=false
 
     depends_on:
       db: