* feat(nsjail): optional disk-backed /tmp via instance setting
* test(nsjail): unit-test tmp mount resolver and narrow visibility
* refactor(nsjail): switch tmp backing to select + conditional UI
* ui(nsjail): make tmpfs the visible default in /tmp backing select
* fix(nsjail): refuse preexisting jail_tmp to block symlink escape
* fix(nsjail): allow jail_tmp reuse on sequential nsjail calls
Codex flagged that python/ruby/rust executors invoke nsjail twice per
job_dir (install then run). The previous resolver treated any preexisting
jail_tmp as hostile and silently fell back to tmpfs on the second call,
so disk-backed mode never reached the main script run for those langs.
Use symlink_metadata().is_dir() to distinguish a real directory left by
an earlier call in the same job_dir (safe to reuse) from a symlink or
other entity (still refused, as the codebase-tar escape requires).
Also loosen the frontend visibility predicate: only hide nsjail settings
when job_isolation is explicitly 'none' or 'unshare', so deployments
that enable nsjail via DISABLE_NSJAIL=false with no DB setting can
still see the controls.
* feat(nsjail): make tmpfs size configurable via instance setting
Adds a new `nsjail_tmpfs_size_mb` instance setting that overrides the
size of the `/tmp` tmpfs mount inside the nsjail sandbox across all
languages. When unset, the existing per-language defaults (500MB or
800MB) continue to apply, so no behavior change for existing
deployments.
The setting is exposed under Settings → Jobs and is read at job
execution time, so changes take effect on the next job without a
restart.
Fixes WIN-1963
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor(nsjail): unify default tmpfs size to 800MB
Previously each executor passed its own per-language default (500MB or
800MB) to resolve_nsjail_tmpfs_size. Unify on a single
DEFAULT_NSJAIL_TMPFS_SIZE_BYTES constant (800MB) so the placeholder
behavior is consistent across languages.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(nsjail): resolve tmpfs size outside ruby download closure
The download.ruby config render runs inside a sync closure passed to
par_install_language_dependencies_seq, so `.await` on
resolve_nsjail_tmpfs_size() was a compile error under the `ruby`
feature. Resolve the size once before the closure and capture the
string instead.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs(nsjail): rename resolver to *_bytes and clarify fallback
Addresses CI review feedback:
- Rename `resolve_nsjail_tmpfs_size` to `resolve_nsjail_tmpfs_size_bytes`
so the returned unit is unambiguous at the call site (cubic P2).
- Fix the `NSJAIL_TMPFS_SIZE_MB` doc comment that still said "per-language
default" — there is no per-language fallback anymore, all unset
values resolve to the unified 800MB `DEFAULT_NSJAIL_TMPFS_SIZE_BYTES`
(codex/pi P2).
- Expand the resolver doc to call out that `Some(0)` and negative values
also fall back, since the match arm is `Some(mb) if mb > 0`.
No behavior change.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix: bind /etc resolver files read-only in nsjail sandboxes
* docs(nsjail): explain why per-file /etc resolver binds are load-bearing
The explicit /etc/hosts, /etc/resolv.conf and /etc/hostname binds look
like removable duplication of the read-only /etc bind above them. They
are not: on Kubernetes those files are separate kubelet bind-mounts on
top of /etc and nsjail's read-only remount is non-recursive, so without
these shadow binds they stay writable and a job can persist cross-tenant
DNS poisoning for the pod lifetime. Comment guards against a future
"dedup cleanup" silently reintroducing the vulnerability.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs(nsjail): shorten the load-bearing-bind comment to 3 lines
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* feat: add nu (nushell) support
* add worker tests
* deactivate tables and non-any types below top-level
full support will come in V1
for V0 it's better to keep things minimal and simple
* add syntax highlighting
used python's grammar, since nushell isn't supported by monaco nor svelte-highlights
for V1 nu will get it`s own grammar
* add logo
* partially implement plugin support
* change logo + ability to deploy + nsjail draft
* static variables + get_resource + get_variable
* lsp/dev.nu + initial nu lsp (not working yet)
* make it work with nsjail
* nullguard
* Much more flexible signature parsing and better error-messages
* add init script
* rename nulsp to nu
* install nu to dockerfile
* fix merge
* implement Default for MainArgSignature
* stage NU_CACHE_DIR
* improve dockerfiles
* dev.nu for parser-wasm + flake.nix
* update code for windows
* add nushell to flake
* upload Cargo.lock
* make build.sh work on nixos
* build wasm cli parsers
* add docs to README_DEV.md
* add helper script docker/dev.nu
* improve docker/dev.nu
* fix windows
* commit frontend/package(lock).json
* update cargo.lock
* correctly update cargo.lock
* remove lsp
* update flake.nix to include svelte server and nushell
* Revert base.sql to main
* remove PLUGIN_USE_RE
* make CARGO_PATH private
* add nu to cli
* Change flags to build wasm-nu-parser
* remove flake.nix from parser-wasm
* update wasm-build target
* remove unused import
* add cli support for nu
* update github workflows
* wasm-build 0.17 -> 0.19
* update build script
* update cargo.lock
* Fix typographical error
* start working on java
* do java boilerplate
* implement parser for java
* update Cargo.lock
* update ENV_SETTINGS
* use published nu parser
* update package.lock
* java is S3 + Caching enabled
* install nsjail backup
* commit v0
* fix nsjail
* v0.1
* rewrite parser in tree-sitter
* implement parser from scratch
* polishing
* change init script to match new parser
* fix imports
* fix cli build
* fix cli build
* refactor install phase
* implement .valid.windmill atomic verification
* implement java init functionality
* remove quick-xml
* fix windows not recognizing 'mvn'
* create empty settings.xml if there is no config provided
* clean up
* change default settings.xml
* change classpath format for windows
* docs to helper
* java copy bin cache instead of symlink
* remove comments
* merge
* fix package.json
* fix package.json 2
* minor fixing
* migrate to Coursier
* update misc
* Http(s) Proxy + CA certs
* remove unused .wasm
* make requirements insensitive to spaces
* update handle_child refs
* rework save_cache for directories
* fix s3 bug
* compile .wasm for cli
* remove uuid import
* fix compilation
* use reference
* fix zero-dep failure
* removing unsafe stuff
* remove unneeded imports
* revert: we still need winapi
* remove nix store from nsjail
* do not create cache_nomount
* add java to dnt
* remove duplicated dependency in init script
* fix typos
* fix CI
* use published parser
Ruben Fiszel
hugocasa
pyranota