* feat: register mounted CA certificates in windmill_extra at startup
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: only claim a CA update when update-ca-certificates can read the mount
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: detect mounted CA certificates the way update-ca-certificates finds them
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(self-host): accept pre-2.11 Caddyfiles in the caddy-l4 image
The Caddyfile is a bind-mounted file the user owns, so `docker compose pull`
updates the image but never their config. #10106 and #10113 changed the syntax
the image requires (native caddy-l4 `route { proxy { upstream } }`, and a
non-empty `bind`), which strands every existing self-host on their next pull:
Error: adapting config using caddyfile: parsing caddyfile tokens for 'layer4':
wrong argument count or unexpected line ending after 'proxy', at line 4
Normalize legacy Caddyfiles in the entrypoint instead. Only rewrite when the
config cannot be used as-is, and on any failure exec caddy against the user's
original file so it reports a real error against what they wrote.
The bind rewrite is not cosmetic: an empty `bind {$ADDRESS}` adapts and
validates cleanly on caddy >= 2.9 but drops the whole HTTP site, so a
syntax-only shim would trade a restart loop for a container that boots clean
and serves nothing on :80.
The reference for correctness is the image published before #10106
(sha-989c9e6): whatever it adapts today is what self-hosters run, so the shim
must reproduce it byte for byte. docker/test-caddy-compat.sh asserts that over
five legacy variants, plus the :80 listener under an unset ADDRESS, every
--config spelling, relative and glob imports, and the no-op on the current
Caddyfile.
Details worth knowing:
- `to a b` becomes one `upstream` per address; `upstream a b` would be a single
upstream with two dials, which is a different load-balancing topology.
- The rewrite lands next to the original, because caddy resolves `import`
relative to the importing file and a glob import would otherwise silently
expand to nothing.
- The image has no ENTRYPOINT and CMD ["caddy", ...], so an existing
`command:` override starts with a `caddy` token the entrypoint absorbs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(self-host): route ws_mp and ws_debug to the extra gateway
reverse_proxy only reads its first argument as a matcher, so
reverse_proxy /ws/* /ws_mp/* /ws_debug/* http://windmill_extra:3000
adapts to a single /ws/* route whose upstreams are `ws_mp/*:80`,
`ws_debug/*:80` and `windmill_extra:3000`. LSP therefore round-robins across
two garbage hostnames and connects only one time in three, while /ws_mp/* and
/ws_debug/* match no route at all and fall through to windmill_server:8000.
Use a named matcher so all three paths reach the gateway. Verified with traffic
against separate windmill_server and windmill_extra backends: before, /ws/lsp
fails and /ws_mp/room reaches windmill_server; after, all three reach the
gateway with the path preserved and /user/login still reaches windmill_server.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(self-host): pin the caddy-l4 image to an explicit version
:latest and the bind-mounted ./Caddyfile it has to agree with are updated by
different mechanisms, so they drift. Publish an explicit version alongside
:latest and pin docker-compose.yml to it, so a checkout is self-consistent:
compose, Caddyfile and image version now move together in one commit.
CI fails the build when docker/caddy-l4.version and the docker-compose.yml pin
disagree, and runs the compatibility-shim tests before publishing. The path
filter now covers the entrypoint, the normalizer, the Caddyfile and
docker-compose.yml, so a change to any guarded input actually triggers the
workflow rather than leaving the check unrun.
:latest keeps being published, since existing deployments reference it and that
is how they pick up the compatibility shim.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(self-host): make the caddy-l4 version tag publishable before the pin merges
docker-compose.yml pins an exact tag, but the version tag was gated on the
default branch, so the tag only appeared after the pin had already merged.
Between the merge and the build finishing, a fresh `docker compose up -d` off
main fails with "manifest unknown", and a failed build leaves main permanently
referencing an image that does not exist.
Drop the gate so the tag can be published from the branch via
workflow_dispatch before merging the pin. The version is immutable, so
republishing it from main is a no-op, and only pushes to main and manual
dispatch run this workflow, so a branch cannot claim the tag by accident.
:latest stays gated on main.
Also check the version file against the caddy version the Dockerfile pins.
Without it, a caddy bump that forgets the version file publishes a tag naming
the wrong caddy.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(self-host): do not log Caddyfile contents from the compat shim
The shim logged a unified diff of the rewrite, which carries three lines of
context around each change. A Caddyfile is user-owned and can hold basic_auth
hashes, proxy Authorization headers or TLS provider tokens, and container logs
are routinely shipped off the host, so normalizing a customized config could
copy secrets into them. Reproduced with a basic_auth bcrypt hash landing in the
log as context around the bind rewrite.
Log the number of rewritten lines and the path to the rewritten file instead.
It sits next to the original, so an operator can diff it themselves.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The /ws_debug debugger WebSocket gated JWT signature verification on inline
`code` being present (`if (code && REQUIRE_SIGNED_REQUESTS)`), so a
`program`-mode launch (naming an arbitrary server-side file path that is read
and executed) skipped verification entirely — even with
REQUIRE_SIGNED_DEBUG_REQUESTS=true. The WS handshake also performed no Origin
check, allowing cross-origin (CSWSH) drive-by from a malicious page.
- Enforce signing on every launch in both handlers (Python + Bun/TS): reject
program-mode outright and require+verify a token for inline code.
- Add opt-in DEBUG_ALLOWED_ORIGINS allowlist enforced at the WS handshake.
- Default docker-compose REQUIRE_SIGNED_DEBUG_REQUESTS to true.
- Update THREAT_MODEL T8/EP15 to reflect the root cause and mitigation.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(sandbox): pull/extract images with crane instead of podman (+ add to image)
The sandboxed container runtime (`# sandbox <image>`) only ever pulls + flattens an
image (nsjail does the run), so a full container engine is overkill — and podman was
never actually in any Dockerfile, so the merged feature couldn't run in the shipped
image. Switch to crane (google/go-containerregistry): a single ~25MB static binary,
no daemon/store/root/privileged.
- docker_v2.rs: crane export -> flattened rootfs tar, crane config -> OCI config,
crane digest -> content-addressed rootfs+config cache (cross-job dedup + automatic
freshness), crane manifest -> pre-download size guard. DOCKER_CONFIG authfile dir.
Cache eviction prunes the rootfs-tar cache by mtime (LRU). Pull policy honored via a
ref->digest cache (missing/never reuse without a registry hit).
- Dockerfile + docker/DockerfileSlim{,Ee}: install the crane binary (Full/FullEe and
the EE image inherit it via FROM the base image).
- docs + UI text + instance-setting descriptions updated (download size is compressed;
cache is the rootfs-tar cache).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(sandbox): address CI review — digest-pinned fetch, size cap on every job, eviction race
Codex P1s:
- Fetch by the resolved digest (name@digest), not the mutable tag, so content can't
diverge from the digest the cache is keyed under if a tag moves mid-fetch.
- Enforce the size cap on EVERY job via a cached {digest}.size sidecar (no registry call
on cache reuse), so lowering the limit rejects already-cached oversized images.
- Eviction race: hardlink the cache tar into the job dir before tar -xf (pins the inode
against concurrent eviction) and re-fetch if it was evicted first.
Claude P2s: atomic config sidecar (tmp+rename) + tolerate torn parse; soften the LRU
comment (mtime = creation order); sweep orphaned *.tmp.* and .size on eviction.
+digest_key/ref_key unit tests.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(sandbox): P1 cross-fs cache staging (EXDEV), Dockerfile arch fail-fast
CI re-review (Claude + Codex P1): the eviction-race hardlink crosses filesystems in the
shipped deployments — the cache is its own volume (/tmp/windmill/cache) while the job dir
is on the container fs — so hard_link returns EXDEV (not NotFound) and every sandbox job
fails. Fall back to tokio::fs::copy on a non-NotFound link error; copy reads through the
source inode so it still survives a concurrent eviction.
Also: Dockerfiles fail fast with a clear error on an unsupported arch instead of building
a 404 crane URL; ref->digest file written via tmp+rename (no torn read under missing/never).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(sandbox): say 'oldest by creation time' not 'LRU' for cache eviction
Codex P2: the code evicts by tar creation time (cache hits don't touch mtime), so the
user-facing docs + instance-setting text shouldn't claim true LRU.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: add sandboxed docker v2 runtime via '# docker <image>'
Run a container image as a subprogram of the job's own nsjail sandbox:
extract the image rootfs with podman (rootless) and run it chrooted inside the
job's nsjail, so the container inherits the job's confinement and is safe under
nsjail / for untrusted code. Selected by '# docker <image>'; a bare '# docker'
keeps the v1 (dind) path untouched.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: default to daemonless docker (drop dind from compose, allow docker on cloud)
docker-compose no longer ships the dind sidecar (v2 is daemonless: podman + nsjail
in the worker); removed the dind service, DOCKER_HOST env, depends_on and volume.
Removed the language-picker guard that blocked Docker scripts on the multi-tenant
platform, now that v2 makes docker safe to run sandboxed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: select sandboxed container via # sandbox <image>; add pull policy + size guards
- Surface moved from '# docker <image>' to '# sandbox <image>' (groups under the
sandbox annotation; '# docker' stays v1-only, '# sandbox' stays nsjail-bash).
- SANDBOX_IMAGE_PULL_POLICY (default 'newer') so moving tags don't go stale.
- SANDBOX_IMAGE_MAX_SIZE_MB rejects oversized images before extraction.
- SANDBOX_IMAGE_CACHE_MAX_MB best-effort LRU eviction of podman's image store.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(sandbox): support # volume, honor nsjail tmp instance settings, v2 docker template
- Thread shared_mount into the sandbox container nsjail config so '# volume' mounts
(and the same-worker /tmp/shared folder) apply inside the container.
- Use resolve_nsjail_tmp_mount_block for the container's /tmp so it honors the same
nsjail_tmp_backing / nsjail_tmpfs_size_mb instance settings as other nsjail jobs.
- docker-compose comment + the editor's Docker template now use '# sandbox <image>'.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(sandbox): make image size/cache/pull-policy UI instance settings
Convert SANDBOX_IMAGE_* from worker env vars to DB-backed instance settings
(sandbox_image_max_size_mb, sandbox_image_cache_max_mb, sandbox_image_pull_policy),
hot-reloaded via the same mechanism as nsjail_tmpfs_size_mb and configurable in
#superadmin-settings. No worker restart needed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(sandbox): windmill-managed registry — default registry + private auth
Two new instance settings:
- sandbox_image_default_registry: prepended to unqualified image refs (alpine ->
<registry>/alpine); fully-qualified refs untouched.
- sandbox_registry_auth: docker/podman auth.json blob written to a per-job authfile
(0600, removed with the job) and passed to podman --authfile for private registries.
Both hot-reloaded and configurable in #superadmin-settings.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(sandbox): protobuf-safe proto_str escaper, atomic 0600 authfile, registry tests
Addresses local-review P2s: proto_str now emits valid protobuf octal escapes for
control/non-ASCII bytes (not Rust \u{..} that nsjail would reject); the registry
authfile is created 0600 atomically (no world-readable window); add a
registry_qualified table test + a non-ASCII proto_str case.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(sandbox): P0 — deliver image env via nsjail envar:, never the launcher process env
CI review (P0): the image's OCI Env (attacker-controlled keys+values) was applied to
the nsjail launcher process via .envs(), so a hostile image could set LD_PRELOAD/
LD_LIBRARY_PATH/LD_AUDIT on nsjail itself and execute code as the worker outside the
jail. Now the image env is rendered as proto-escaped 'envar:' directives (child-only)
and nsjail's process env carries only windmill-trusted keys (reserved vars + proxy).
Also: warn instead of silently bypassing the size guard on inspect failure; reset the
eviction guard via a Drop guard (no stuck flag on panic/early-return). +render_envars test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(sandbox): P0 symlink-write escape via rootfs script; P1 redact registry-auth logging
CI review:
- P0 (Codex): the body was written into the image-controlled rootfs as
.windmill_docker_main.sh via write_file (follows symlinks) — a hostile image could
plant that path as a symlink to a host file and capture the worker's write before
nsjail starts. Now the body is passed straight to 'sh -c <body> sh <args>'; no file
is written into the rootfs at all.
- P1 (Codex): sandbox_registry_auth flowed through the generic setting loader which
logs the value (raw auth.json credentials). Replaced with a secret-aware reload that
loads directly and logs only a redacted 'configured=' message.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(sandbox): redact sandbox_registry_auth in instance-settings write log too
The settings API also logs 'Set global setting <key> to <value>' via format_setting_value;
add sandbox_registry_auth to SENSITIVE_SETTINGS so the credential is redacted there as
well as on reload.
* fix(sandbox): don't silently disable cache eviction on podman images parse error
Re-review (cubic/Claude P2): serde_json::from_slice(...).unwrap_or_default() meant any
parse hiccup (e.g. podman omitting Size/Created via omitempty for a zero value, or
schema drift) silently degraded to an empty Vec and disabled eviction with no log.
Now Size/Created are #[serde(default)] (a missing omitempty key -> 0, not a whole-array
parse failure) and a real parse error warns + breaks instead of being swallowed.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: replace host docker socket with dind sidecar for isolation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: comment out dind sidecar by default to avoid wasting resources
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: enable dind by default, comment out insecure host socket mount
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Updates the debugger service to use port 3003 instead of 5679 across
all configuration files, documentation, and code references. This aligns
the debugger with the other windmill-extra services which use ports
3001 (LSP) and 3002 (Multiplayer).
Changes:
- docker-compose.yml: Update port exposure and add DEBUGGER_PORT env
- docker/entrypoint-extra.sh: Change default port from 5679 to 3003
- debugger/dap_debug_service.ts: Update default port in code and docs
- debugger/README.md: Update port documentation
- debugger/test_debug_service.ts: Update test URLs
- docker/test_windmill_extra.ts: Update test configuration
- .github/workflows/publish_extra.yml: Update test container ports
- frontend/src/lib/components/debug/*: Update frontend examples and defaults
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* use own folder for memory
* fixes
* better chat interface
* fix export tab
* move in folder
* dont show flow graph if chat mode
* fix
* fix too long title
* fix user message
* fix
* fix
* remove from server
* cleaner
* cleaning
* cleaning
* cleaning
* main docker file
* fix docker image build test tag
* don't remove tag
* make root user default
* chown tmp folder
* create search and logs folder in order to inherite windmill user permissions
* Dockerfile
* lsp non root
* improving lsp image to get rid of critical vulnerabilities
* formatting
* support /root/.cache mount
* make the cache mount backwards compatible
* Add indexer crate and files
* POC searcher
incomplete schema
only indexes at startup
* POC search component frontend
* Demo of the frontend element
* add Results and Args as text
* minimal functionality
* Make jump to scripts by name
also flows and apps
* Add button on sidebar to open search
* Update lock on indexer after merge
* Make arrow key navigation compatible with scrol
* Show empty result screen and log as a coming feat
* Add summary to script searchable items
* Catch `parts is undefined` error (uFuzzy)
* Index refreshing using tokio interval
* Fix JobLoader workspace being wrongly defined
* Fix click outside
* Add debouncing for completed run search
* Binary mode working + job index tracker
* Warning for no license + fix height scrollbars on content search
* Make it compile without EE files
* remove panic to use errors
* Move global search
* Cleanup UI, no more tab switcher but clear placeholders and actions
* Add tantivy feature flag for windmill-api
* Rework indexer mode
* Mac compatibility for shortcut
* Update test for new run_server
* Prepare sqlx
* Mac compatibility
* Fix openapi yaml
* Fix frontend
* Frontend api fix
* Update docker-compose.yml and caddyfile
With the (by default deactivated) container and reverse proxy to use the
windmill indexer
* fix feature flag for tests
* fix feature falg for running tests
* fix feature flag for running tests
* Make content search use search modal instead
* Add tantivy feature to ee build steps
* Remove old Content search
* change volume location for indexer
* Update dependencies
* Prepare sqlx
* Uncomment line on docker compose
* Add line between input and results
* Update ee repo ref
Ruben Fiszel
hugocasa
Alexander Petric
centdix
wendrul
Henri Courdent
Ruben Fiszel
Jacopo Bonomi
Bret Mogilefsky
Guillaume Bouvignies