mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-18 16:02:10 +00:00
Ruben Fiszel
154f8f461e
* feat(debugger): install debug session deps from the instance registry settings Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(debugger): keep install-time registry credentials out of the session-visible tree Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: drop em dashes from the debugger registry docs and comments Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(debugger): stop installing for a session that went away during the settings fetch Also serves nativets sessions the npm settings their installer reads. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
114 lines
1.7 KiB
Protocol Buffer
114 lines
1.7 KiB
Protocol Buffer
name: "debugger sandbox"
|
|
|
|
mode: ONCE
|
|
hostname: "debugger"
|
|
log_level: ERROR
|
|
|
|
disable_rl: true
|
|
|
|
mount_proc: true
|
|
|
|
clone_newnet: false
|
|
clone_newuser: true
|
|
clone_newcgroup: false
|
|
|
|
skip_setsid: true
|
|
keep_caps: false
|
|
keep_env: true
|
|
|
|
# System directories (read-only)
|
|
mount {
|
|
src: "/bin"
|
|
dst: "/bin"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/lib"
|
|
dst: "/lib"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/lib64"
|
|
dst: "/lib64"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/usr"
|
|
dst: "/usr"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/etc"
|
|
dst: "/etc"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/sys/fs"
|
|
dst: "/sys/fs"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
# Bind-mount /tmp from host (job directories are created here)
|
|
mount {
|
|
src: "/tmp"
|
|
dst: "/tmp"
|
|
is_bind: true
|
|
rw: true
|
|
}
|
|
|
|
# Private scratch, one instance per jail. `windmill prepare-deps` writes the registry
|
|
# credentials here rather than into its install directory under the shared /tmp above, so no
|
|
# other session can read them, and they go away with the jail even when it is killed.
|
|
mount {
|
|
dst: "/var/tmp"
|
|
fstype: "tmpfs"
|
|
rw: true
|
|
}
|
|
|
|
# Debugger scripts directory (for Python debugger server)
|
|
mount {
|
|
src: "/debugger"
|
|
dst: "/debugger"
|
|
is_bind: true
|
|
}
|
|
|
|
# Device nodes
|
|
mount {
|
|
src: "/dev/null"
|
|
dst: "/dev/null"
|
|
is_bind: true
|
|
rw: true
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/random"
|
|
dst: "/dev/random"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/urandom"
|
|
dst: "/dev/urandom"
|
|
is_bind: true
|
|
}
|
|
|
|
# Home directory (for bun cache etc)
|
|
mount {
|
|
dst: "/root"
|
|
fstype: "tmpfs"
|
|
rw: true
|
|
}
|
|
|
|
iface_no_lo: true
|
|
|
|
envar: "HOME=/root"
|
|
envar: "TMPDIR=/tmp"
|
|
envar: "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|