Ruben Fiszel and Claude Opus 4.7
f8467f38c8
fix: prevent cross-tenant DNS poisoning via writable /etc in nsjail ( #9194 )
...
* fix: bind /etc resolver files read-only in nsjail sandboxes
* docs(nsjail): explain why per-file /etc resolver binds are load-bearing
The explicit /etc/hosts, /etc/resolv.conf and /etc/hostname binds look
like removable duplication of the read-only /etc bind above them. They
are not: on Kubernetes those files are separate kubelet bind-mounts on
top of /etc and nsjail's read-only remount is non-recursive, so without
these shadow binds they stay writable and a job can persist cross-tenant
DNS poisoning for the pod lifetime. Comment guards against a future
"dedup cleanup" silently reintroducing the vulnerability.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
* docs(nsjail): shorten the load-bearing-bind comment to 3 lines
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
---------
Co-authored-by: Claude <noreply@anthropic.com >
2026-05-17 12:54:38 +00:00
pyranota and ellipsis-dev[bot]
11dd4118ce
feat: add ruby support ( #5939 )
...
* implement single line pin
* make panic-safe
* use pin even if multiple modules imported withing single statement
* add repins and make imports respect pins
* keep all pins
* Allow multiple pins
* add comments + handle stuff more safely
* fix fully qualified imports
* remove ignore
* sort nested
* apply unique to output requirements list
* fix typo
* remove mut
* update sqlx
* sort imports
* sort imports
* fix formatter and format
* feat: add ruby support
* fix
* update sqlx
* add ruby to flake.nix
Signed-off-by: pyranota <pyra@duck.com >
* upgrade par_install_language_dependencies helper
rename fields + allow passing custom payload
Signed-off-by: pyranota <pyra@duck.com >
* change migrations
Signed-off-by: pyranota <pyra@duck.com >
* make full pipeline work!
Signed-off-by: pyranota <pyra@duck.com >
* do a bit fixing
* stage
Signed-off-by: pyranota <pyra@duck.com >
* add ruby in dockerfiles
Signed-off-by: pyranota <pyra@duck.com >
* implement auto-require + 'windmill/inline'
Signed-off-by: pyranota <pyra@duck.com >
* create 'windmill/inline' only if does not exist
Signed-off-by: pyranota <pyra@duck.com >
* add nsjail
Signed-off-by: pyranota <pyra@duck.com >
* update global settings
Signed-off-by: pyranota <pyra@duck.com >
* add ruby icon
* generate lockfile on deploy (but broken)
Signed-off-by: pyranota <pyra@duck.com >
* fix(frontend): display deployed script lockfile and other info
Signed-off-by: pyranota <pyra@duck.com >
* feat: add mini-wmill client
Methods:
- get_resource
- get_variable
Additionally add shortcuts on frontend
Signed-off-by: pyranota <pyra@duck.com >
* add nit warning
Signed-off-by: pyranota <pyra@duck.com >
* support private repos credentials
Signed-off-by: pyranota <pyra@duck.com >
* fix compilation error
Signed-off-by: pyranota <pyra@duck.com >
* found rustc bug + refactor universal installer
Signed-off-by: pyranota <pyra@duck.com >
* more refactor + fixes
Signed-off-by: pyranota <pyra@duck.com >
* bug fixing + polishing
Signed-off-by: pyranota <pyra@duck.com >
* cleanup
Signed-off-by: pyranota <pyra@duck.com >
* change 'windmill/inline'
Signed-off-by: pyranota <pyra@duck.com >
* delegate env_clear to universal installer
Signed-off-by: pyranota <pyra@duck.com >
* update init script
Signed-off-by: pyranota <pyra@duck.com >
* add cli support
Signed-off-by: pyranota <pyra@duck.com >
* unhardcode frontend
Signed-off-by: pyranota <pyra@duck.com >
* fix cli
Signed-off-by: pyranota <pyra@duck.com >
* fix init script
Signed-off-by: pyranota <pyra@duck.com >
* make it work on ms windows
Signed-off-by: pyranota <pyra@duck.com >
* do not clean env in the end
Signed-off-by: pyranota <pyra@duck.com >
* fix windows (again)
Signed-off-by: pyranota <pyra@duck.com >
* include PROXY_ENVS (untested)
Signed-off-by: pyranota <pyra@duck.com >
* feat: self-signed certs + proxy support (tested)
Signed-off-by: pyranota <pyra@duck.com >
* flake: pin ruby to 3.4
* merge follow-ups
Signed-off-by: pyranota <pyra@duck.com >
* remove obsolete libc crate
Signed-off-by: pyranota <pyra@duck.com >
* cleanup parser
Signed-off-by: pyranota <pyra@duck.com >
* fix java ci
Signed-off-by: pyranota <pyra@duck.com >
* cleanup
Signed-off-by: pyranota <pyra@duck.com >
* fix nits
Signed-off-by: pyranota <pyra@duck.com >
* Update backend/windmill-worker/src/universal_pkg_installer.rs
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
* Update backend/windmill-worker/src/ruby_executor.rs
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
* add nsjail for lock stage
Signed-off-by: pyranota <pyra@duck.com >
* fix merge
Signed-off-by: pyranota <pyra@duck.com >
* Update common.rs
* regen windmill-api-client
Signed-off-by: pyranota <pyra@duck.com >
* fix tests
Signed-off-by: pyranota <pyra@duck.com >
* fix tests again
Signed-off-by: pyranota <pyra@duck.com >
* reference published ruby parser
Signed-off-by: pyranota <pyra@duck.com >
---------
Signed-off-by: pyranota <pyra@duck.com >
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
2025-08-15 13:03:32 +00:00
Ruben FiszelandClaude Opus 4.7
Pyra
