Remove the `docker_image_storage_size_mb` instance setting and the polling
storage monitor entirely. Now that `# docker` jobs are refused under nsjail
(the per-job podman daemon runs outside the sandbox), the asymmetry that
justified a docker-specific disk cap is gone: a normal job can already exhaust
host disk in non-nsjail modes, so a docker-only cap was inconsistent. Docker
jobs now use disk like any other job — bound it at the infra level.
Also scope the rootless slirp4netns network-backend override to the per-job
podman instance via a job-scoped `$HOME` containers.conf instead of a global
`/etc/containers` drop-in, so rootful podman elsewhere in the *-full image is
unaffected (flagged by cubic).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Comment-only cleanup flagged in review:
- PerJobPodman struct doc: it's used for docker jobs in ANY sandbox mode (not just
nsjail), and teardown is `podman system reset` (removes images + subuid-owned
layers), not `rm -af` + kill service.
- connect_docker / handle_docker_job param comments: drop the "(nsjail path)" — per-job
podman runs in all modes now.
- DockerfileFull/FullEe: the container_runtime config was removed; podman is started
automatically when no Docker daemon is provided.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
docker-compose.yml / README: remove the legacy dind sidecar and the
DOCKER_HOST/host-socket opt-in comments (confusing now that podman is the way).
Present a single clean path: a dedicated windmill_worker_docker group with the
rootless podman runtime (full image, user 1000, privileged + /dev/fuse,
CONTAINER_RUNTIME=podman, WORKER_TAGS=docker). `# docker` scripts are tagged by
language ("bash"), so routing is via a custom "docker" tag — documented. The
legacy externally-provided DOCKER_HOST / mounted /var/run/docker.sock still works
in the backend; it's just no longer advertised in the quickstart.
DockerfileFull/FullEe: two fixes required for podman-in-container (found by
testing a containerized worker):
- chmod u+s newuidmap/newgidmap — rootless subuid mapping fails if the package's
file caps are lost in image layers.
- default rootless networking to slirp4netns (containers.conf.d) — the netavark
bridge default fails rootless on hosts without the needed nftables setup.
Verified e2e (podman-in-docker): a containerized worker ran a # docker job via
per-job rootless podman with both fixes + privileged + /dev/fuse; confinement held.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add podman + crun + uidmap + fuse-overlayfs + slirp4netns and a windmill user
(uid 1000) with a subuid/subgid range to DockerfileFull and DockerfileFullEe, so
the `container_runtime: podman` worker-group option works out of the box on the
*-full images. Run the docker worker group as `user: "1000:1000"` for a rootless
(unprivileged) daemon; root still works but is rootful.
Base/slim images are untouched (kept lean). Verified on debian:bookworm-slim:
packages resolve (podman 4.3.1), user + subuid set up, ~103MB layer delta
(rounding error on the multi-GB full image).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: add R language support
Add R as a new supported scripting language in Windmill, following the
same pattern used for Ruby. Includes:
- Backend: ScriptLang::Rlang enum variant, DB migration, tree-sitter-r
parser crate with tests, WASM parser binding, R executor with NSJail
sandboxing, job dispatch and signature parsing
- Frontend: language picker, R icon, syntax highlighting, editor bar
insertions (Sys.getenv, get_variable, get_resource), schema inference,
init code template, BETA badge
- CLI: .r extension mapping, sync support, bootstrap template
R scripts use `main <- function(...)` syntax, jsonlite for JSON
serialization, and system curl for the Windmill client helper.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add R package resolution and installation
Parse library()/require() calls from R scripts to extract dependencies.
Resolve versions from CRAN, cache lockfiles in pip_resolution_cache,
and install packages to a shared R library cache. The run step sets
R_LIBS_USER so installed packages are available to the script.
- Parser: parse_r_requirements() extracts package names from AST
- Executor: resolve() generates lockfile, install() installs from CRAN
- Worker lockfiles: wire up R resolve for dependency jobs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add nsjail sandboxing for R resolve and install phases
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: fix R get_variable/get_resource and add sandbox annotation + e2e tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: fix R arg inference with JS fallback parser and get_variable/get_resource
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix flake
* nsjail
* nits
* fix: R install improvements - suppress verbose output, flat lockfile logging, Dockerfile R support, rlimits
- Suppress renv verbose output during resolve and install (controlled by #verbose annotation)
- Filter renv from install list (already loaded, causes noisy restart message)
- Log compact "resolved N packages" instead of full renv.lock JSON
- Add R (r-base, r-cran-renv) to DockerfileFull and DockerfileFullEe
- Use disable_rl for nsjail install config (R compiles from source)
- Reduce default concurrency from 20 to 5
- Add rlang to openflow.openapi.yaml
- Fix MainArgSignature (no_main_func -> auto_kind) after main merge
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* final
* fix: remove accidental R install from multiplayer Dockerfile
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: remove R from Windows build and DockerfileExtra
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: rename R migration to avoid timestamp collision with trigger_filter_logic
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* all
* fix: R install improvements - suppress verbose output, flat lockfile logging, Dockerfile R support, rlimits
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: add clear error when Rscript binary is missing
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: fix type errors in R fallback parser, use format! in wrap(), add R system prompts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: pyranota <pyra@duck.com>
* feat: add nu (nushell) support
* add worker tests
* deactivate tables and non-any types below top-level
full support will come in V1
for V0 it's better to keep things minimal and simple
* add syntax highlighting
used python's grammar, since nushell isn't supported by monaco nor svelte-highlights
for V1 nu will get it`s own grammar
* add logo
* partially implement plugin support
* change logo + ability to deploy + nsjail draft
* static variables + get_resource + get_variable
* lsp/dev.nu + initial nu lsp (not working yet)
* make it work with nsjail
* nullguard
* Much more flexible signature parsing and better error-messages
* add init script
* rename nulsp to nu
* install nu to dockerfile
* fix merge
* implement Default for MainArgSignature
* stage NU_CACHE_DIR
* improve dockerfiles
* dev.nu for parser-wasm + flake.nix
* update code for windows
* add nushell to flake
* upload Cargo.lock
* make build.sh work on nixos
* build wasm cli parsers
* add docs to README_DEV.md
* add helper script docker/dev.nu
* improve docker/dev.nu
* fix windows
* commit frontend/package(lock).json
* update cargo.lock
* correctly update cargo.lock
* remove lsp
* update flake.nix to include svelte server and nushell
* Revert base.sql to main
* remove PLUGIN_USE_RE
* make CARGO_PATH private
* add nu to cli
* Change flags to build wasm-nu-parser
* remove flake.nix from parser-wasm
* update wasm-build target
* remove unused import
* add cli support for nu
* update github workflows
* wasm-build 0.17 -> 0.19
* update build script
* update cargo.lock
* Fix typographical error
* start working on java
* do java boilerplate
* implement parser for java
* update Cargo.lock
* update ENV_SETTINGS
* use published nu parser
* update package.lock
* java is S3 + Caching enabled
* install nsjail backup
* commit v0
* fix nsjail
* v0.1
* rewrite parser in tree-sitter
* implement parser from scratch
* polishing
* change init script to match new parser
* fix imports
* fix cli build
* fix cli build
* refactor install phase
* implement .valid.windmill atomic verification
* implement java init functionality
* remove quick-xml
* fix windows not recognizing 'mvn'
* create empty settings.xml if there is no config provided
* clean up
* change default settings.xml
* change classpath format for windows
* docs to helper
* java copy bin cache instead of symlink
* remove comments
* merge
* fix package.json
* fix package.json 2
* minor fixing
* migrate to Coursier
* update misc
* Http(s) Proxy + CA certs
* remove unused .wasm
* make requirements insensitive to spaces
* update handle_child refs
* rework save_cache for directories
* fix s3 bug
* compile .wasm for cli
* remove uuid import
* fix compilation
* use reference
* fix zero-dep failure
* removing unsafe stuff
* remove unneeded imports
* revert: we still need winapi
* remove nix store from nsjail
* do not create cache_nomount
* add java to dnt
* remove duplicated dependency in init script
* fix typos
* fix CI
* use published parser
* feat: add nu (nushell) support
* add worker tests
* deactivate tables and non-any types below top-level
full support will come in V1
for V0 it's better to keep things minimal and simple
* add syntax highlighting
used python's grammar, since nushell isn't supported by monaco nor svelte-highlights
for V1 nu will get it`s own grammar
* add logo
* partially implement plugin support
* change logo + ability to deploy + nsjail draft
* static variables + get_resource + get_variable
* lsp/dev.nu + initial nu lsp (not working yet)
* make it work with nsjail
* nullguard
* Much more flexible signature parsing and better error-messages
* add init script
* rename nulsp to nu
* install nu to dockerfile
* fix merge
* implement Default for MainArgSignature
* stage NU_CACHE_DIR
* improve dockerfiles
* dev.nu for parser-wasm + flake.nix
* update code for windows
* add nushell to flake
* upload Cargo.lock
* make build.sh work on nixos
* build wasm cli parsers
* add docs to README_DEV.md
* add helper script docker/dev.nu
* improve docker/dev.nu
* fix windows
* commit frontend/package(lock).json
* update cargo.lock
* correctly update cargo.lock
* remove lsp
* update flake.nix to include svelte server and nushell
* Revert base.sql to main
* remove PLUGIN_USE_RE
* make CARGO_PATH private
* add nu to cli
* Change flags to build wasm-nu-parser
* remove flake.nix from parser-wasm
* update wasm-build target
* remove unused import
* add cli support for nu
* update github workflows
* wasm-build 0.17 -> 0.19
* update build script
* update cargo.lock
* Fix typographical error
* update Cargo.lock
* update ENV_SETTINGS
* use published nu parser
* update package.lock
* rewrite parser in tree-sitter
* implement parser from scratch
* polishing
* change init script to match new parser
* fix imports
* fix cli build
* fix cli build
* merge
* update wasm
* use MiniPulledJob
* update cli
* change cli wasm schema
* change cli
* update deno.json
* make wasm modules load lazily
* regenerate parsers
* remove leftover
* update cargo.lock
* clean up dnt.ts
* add docs to cli/test.nu
* add schema validation option
* add Nu to try_validate_schema
* reference frontend to new parser version
* Add csharp stuff and merge after the rewrite
* Add csharp, boilerplate + minimal execution
* Add initial parser
* Frontend + wasm export of the tree sitter parser
* Arg spread and use cache
* More types and req parsing
* Add logo
* Parse async and void to fit the wrapper to the main sig
* Csharp editor resource and var buttons
* Lockfile generation
* Add default parsing using serde_json::from_str
* Update init code for c#
* Nsjail for c#
* Remove c_variadic feature
* Remove unused imports
* Add c_variadic only for wasm32 assembly
* Fix c# test
* Add dotnet to the images
* Update dockerfiles
* Update dockerfile again
* Touch Dockerfile
* npm install c# parser
* Add opt mount in nsjail
* Update ee repo ref
* Add csharp to backend image for tests
* Add setting to set nuget package
* Windows compatibility
* Disable csharp test
* ADd feature flag
Ruben FiszelandClaude Opus 4.8
Alexander Petric
pyranotaandellipsis-dev[bot]
Ruben Fiszel
Tsvetomir Bonev
wendrul