* feat: register mounted CA certificates in windmill_extra at startup
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: only claim a CA update when update-ca-certificates can read the mount
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: detect mounted CA certificates the way update-ca-certificates finds them
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: forward proxy and TLS settings to debugger subprocesses
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: reach uv and the bun debugger with the forwarded network settings
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: map every CA variable spelling onto the one uv reads
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep package-index credentials out of debugged user code
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: install debugger dependencies outside the interpreter running user code
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: sandbox and bound the debugger dependency installer
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: correct the installer timeout rationale
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: scope the uv --cert note to the commands prepare-deps runs
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: build the debug venv against the interpreter that runs the script
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: do not start the debuggee for a session that already went away
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: remove the debug script when the session is gone before it starts
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(extra): make extra container runnable as a non-root UID
The root-run installs in DockerfileExtra inherit UV_CACHE_DIR
(/tmp/windmill/cache/uv) and XDG_CACHE_HOME (/pyls/.cache) from the base
image and write to them *after* the base image's world-writable pass,
leaving ~320 root-owned 0755 dirs. A non-root UID then fails to debug:
uv venv failed: Failed to write to the client cache
Caused by: Permission denied (os error 13)
at path "/tmp/windmill/cache/uv/simple-v21/pypi/.tmpWxWzTi"
Re-apply the base image's world-writable convention after the installs,
and add the windmill UID/GID 1000 account the app image already has so
runAsUser: 1000 resolves to a real user with a writable $HOME. The
entrypoint also wrote $NETRC to the 0700 /root under `set -e`, killing
the container at startup; redirect $HOME when it is not writable.
Verified against the published image as root, uid 1000, and uid 4567:0:
all four services start and `windmill prepare-deps` succeeds in each.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(extra): scope the HOME fallback per-UID and cover non-root in CI
Review findings on the previous commit:
- `${HOME:-/root}` was used in the writability test but not the assignment,
so an unset HOME (writable /root, redirect skipped) silently wrote the
netrc to `/.netrc` instead of `/root/.netrc`. Normalize HOME once.
- `mkdir -p` succeeds on a dir owned by another UID, so a root-created
/tmp/windmill-home on a shared /tmp reintroduced the startup death this
fix exists to prevent. Scope the fallback to /tmp/windmill-home-$(id -u).
- The extra image's smoke test only ran as root, so nothing exercised the
non-root path this PR is about. Add a --user 1000 run of the same suite
plus a prepare-deps assertion, which is where the EACCES surfaced.
Also correct the DockerfileExtra comment: the proven requirement is the uv
cache, not runtime writes by gopls.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(extra): keep /tmp/monaco code read-only for non-root UIDs
Review nit: /tmp/monaco holds node_modules (code, not cache), so it is not
covered by the base image's world-writable cache convention. Give it a+rX
files with 777 dirs -- enough for the go.mod / ruff.toml the entrypoint and
pyls_launcher write into it -- instead of a+rw on every file.
/tmp/windmill and /pyls/.cache keep a+rw: that is the base convention for
caches (DockerfileSlimEe:69 chmod -R a+rw /tmp/windmill/cache; Dockerfile:339
"cache files already have 666"), and uv rewrites cache entries in place.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(extra): drop the non-root CI smoke test
Reverts publish_extra.yml to its root-only smoke test; the DockerfileExtra
and entrypoint fix is unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: add gateway reverse proxy for extra services
Add a lightweight Node.js gateway on port 3000 that routes requests
by URL prefix (/ws/*, /ws_mp/*, /ws_debug/*) to the correct backend
service, stripping the prefix before forwarding. This allows all
extra services to be accessed through a single port.
Also makes the multiplayer server more tolerant by generically
stripping /ws_mp/ prefix on HTTP requests.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: enable gateway by default for extra services
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: add REMOTE_EXTRA env var for unified extra services proxy
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: make gateway port configurable via PORT env var
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: simplify Caddyfile extra services routing
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The nsjail debugger mode was failing with "chdir('/tmp'): No such file
or directory" because without a config file, nsjail uses minimal mounts
that don't include /tmp or other necessary directories.
Added nsjail.debug.config.proto with proper mounts:
- /bin, /lib, /lib64, /usr, /etc (system directories)
- /tmp as tmpfs (for script execution)
- /dev/null, /dev/random, /dev/urandom (device nodes)
- /root as tmpfs (for bun cache)
Also updated:
- entrypoint-extra.sh: Pass --nsjail-config when ENABLE_NSJAIL=true
- DockerfileExtra: Copy nsjail config, update ports to 3003
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Updates the debugger service to use port 3003 instead of 5679 across
all configuration files, documentation, and code references. This aligns
the debugger with the other windmill-extra services which use ports
3001 (LSP) and 3002 (Multiplayer).
Changes:
- docker-compose.yml: Update port exposure and add DEBUGGER_PORT env
- docker/entrypoint-extra.sh: Change default port from 5679 to 3003
- debugger/dap_debug_service.ts: Update default port in code and docs
- debugger/README.md: Update port documentation
- debugger/test_debug_service.ts: Update test URLs
- docker/test_windmill_extra.ts: Update test configuration
- .github/workflows/publish_extra.yml: Update test container ports
- frontend/src/lib/components/debug/*: Update frontend examples and defaults
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Ruben Fiszel
Fred Reimer