starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-29 00:03:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: add a no_network annotation for sandboxed jobs (#11844)

Browse Source 
* feat: add a no_network annotation for sandboxed python, bash, bun and r jobs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: keep nodejs relative imports and dedicated workers working under no_network

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: bundle bun no_network jobs so relative imports resolve before the run

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: point ee-repo-ref at the runner group no_network fix

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor: state the no_network token rule once

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: refuse no_network jobs whose workspace imports would be fetched at run time

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: let type-only workspace imports through the no_network import check

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: update ee-repo-ref to ca4a1959a0d2257d413a57349939053ac3473c6b

This commit updates the EE repository reference after PR #895 was merged in windmill-ee-private.

Previous ee-repo-ref: 3841923cfd117b6b907ac3e84b26f07bde41f8ed

New ee-repo-ref: ca4a1959a0d2257d413a57349939053ac3473c6b

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
This commit is contained in:
Ruben Fiszel
2026-10-17 09:25:55 +00:00
committed by GitHub
co-authored by Claude Opus 5.5 windmill-internal-app[bot]
parent b0c97b34ca
commit feb7b1ad90
21 changed files with 407 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cli/src/guidance/skills.gen.ts
Generated
+1 -1
View File
@@ -1419,7 +1419,7 @@ export async function main(url: string) {
## Pure computation: \`//no_network\`
A native script that only transforms its inputs can declare \`//no_network\` in its leading comment block (right after \`//native\`). The runtime then refuses every connection the script attempts: \`fetch\` to any host, the Windmill API (so \`windmill-client\` calls fail too), raw sockets and unix sockets, and \`WM_TOKEN\` is not set. It only takes effect on native scripts: without \`//native\` it is ignored. Use it only when the script needs no external data beyond its arguments:
A native script that only transforms its inputs can declare \`//no_network\` in its leading comment block (right after \`//native\`). The runtime then refuses every connection the script attempts: \`fetch\` to any host, the Windmill API (so \`windmill-client\` calls fail too), raw sockets and unix sockets, and \`WM_TOKEN\` is not set. Without \`//native\` it means something else: the script must run in an nsjail sandbox (\`//sandbox\`, or instance-wide sandboxing), which then loses its network, and it fails to run otherwise. Use it only when the script needs no external data beyond its arguments:
\`\`\`typescript
//native