mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-12 00:06:14 +00:00
Ruben FiszelandClaude Opus 4.7
9111f8908d
* feat(nsjail): make tmpfs size configurable via instance setting Adds a new `nsjail_tmpfs_size_mb` instance setting that overrides the size of the `/tmp` tmpfs mount inside the nsjail sandbox across all languages. When unset, the existing per-language defaults (500MB or 800MB) continue to apply, so no behavior change for existing deployments. The setting is exposed under Settings → Jobs and is read at job execution time, so changes take effect on the next job without a restart. Fixes WIN-1963 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(nsjail): unify default tmpfs size to 800MB Previously each executor passed its own per-language default (500MB or 800MB) to resolve_nsjail_tmpfs_size. Unify on a single DEFAULT_NSJAIL_TMPFS_SIZE_BYTES constant (800MB) so the placeholder behavior is consistent across languages. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(nsjail): resolve tmpfs size outside ruby download closure The download.ruby config render runs inside a sync closure passed to par_install_language_dependencies_seq, so `.await` on resolve_nsjail_tmpfs_size() was a compile error under the `ruby` feature. Resolve the size once before the closure and capture the string instead. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(nsjail): rename resolver to *_bytes and clarify fallback Addresses CI review feedback: - Rename `resolve_nsjail_tmpfs_size` to `resolve_nsjail_tmpfs_size_bytes` so the returned unit is unambiguous at the call site (cubic P2). - Fix the `NSJAIL_TMPFS_SIZE_MB` doc comment that still said "per-language default" — there is no per-language fallback anymore, all unset values resolve to the unified 800MB `DEFAULT_NSJAIL_TMPFS_SIZE_BYTES` (codex/pi P2). - Expand the resolver doc to call out that `Some(0)` and negative values also fall back, since the match arm is `Some(mb) if mb > 0`. No behavior change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
958 lines
30 KiB
Rust
958 lines
30 KiB
Rust
use std::{collections::HashMap, process::Stdio};
|
|
|
|
use anyhow::anyhow;
|
|
use itertools::Itertools;
|
|
use regex::Regex;
|
|
use tokio::{
|
|
fs::{self, File},
|
|
io::{AsyncReadExt, AsyncWriteExt},
|
|
process::Command,
|
|
};
|
|
use url::Url;
|
|
use uuid::Uuid;
|
|
use windmill_common::{
|
|
client::AuthedClient,
|
|
error::Error,
|
|
utils::calculate_hash,
|
|
worker::{write_file, Connection, RubyAnnotations},
|
|
};
|
|
use windmill_parser::Arg;
|
|
use windmill_parser_ruby::parse_ruby_signature;
|
|
use windmill_queue::{append_logs, CanceledBy, MiniPulledJob};
|
|
|
|
use crate::{
|
|
common::{
|
|
build_command_with_isolation, create_args_and_out_file, get_reserved_variables,
|
|
read_result, resolve_nsjail_timeout, resolve_nsjail_tmpfs_size_bytes, start_child_process,
|
|
OccupancyMetrics, DEV_CONF_NSJAIL,
|
|
},
|
|
get_proxy_envs_for_lang,
|
|
handle_child::{self},
|
|
is_sandboxing_enabled, read_ee_registry_url_list_with_workspace_override,
|
|
universal_pkg_installer::{
|
|
par_install_language_dependencies_seq, InstallDeps, RequiredDependency,
|
|
},
|
|
DISABLE_NUSER, NSJAIL_PATH, PATH_ENV, PROXY_ENVS, RUBY_CACHE_DIR, RUBY_REPOS,
|
|
TRACING_PROXY_CA_CERT_PATH,
|
|
};
|
|
use windmill_common::scripts::ScriptLang;
|
|
lazy_static::lazy_static! {
|
|
static ref RUBY_CONCURRENT_DOWNLOADS: usize = std::env::var("RUBY_CONCURRENT_DOWNLOADS").ok().map(|flag| flag.parse().unwrap_or(20)).unwrap_or(20);
|
|
static ref RUBY_PATH: String = std::env::var("RUBY_PATH").unwrap_or_else(|_| "/usr/bin/ruby".to_string());
|
|
static ref BUNDLE_PATH: String = std::env::var("RUBY_BUNDLE_PATH").unwrap_or_else(|_| "/usr/bin/bundle".to_string());
|
|
static ref GEM_PATH: String = std::env::var("RUBY_GEM_PATH").unwrap_or_else(|_| "/usr/bin/gem".to_string());
|
|
static ref RUBY_PROXY_ENVS: Vec<(String, String)> = {
|
|
PROXY_ENVS
|
|
.clone()
|
|
.into_iter()
|
|
.map(|(k, v)| (k.to_lowercase(), v))
|
|
.collect()
|
|
};
|
|
}
|
|
|
|
const NSJAIL_CONFIG_RUN_RUBY_CONTENT: &str = include_str!("../nsjail/run.ruby.config.proto");
|
|
const NSJAIL_CONFIG_DOWNLOAD_RUBY_CONTENT: &str =
|
|
include_str!("../nsjail/download.ruby.config.proto");
|
|
const NSJAIL_CONFIG_LOCK_RUBY_CONTENT: &str = include_str!("../nsjail/lock.ruby.config.proto");
|
|
|
|
#[allow(dead_code)]
|
|
pub(crate) struct JobHandlerInput<'a> {
|
|
pub base_internal_url: &'a str,
|
|
pub canceled_by: &'a mut Option<CanceledBy>,
|
|
pub client: &'a AuthedClient,
|
|
pub parent_runnable_path: Option<String>,
|
|
pub conn: &'a Connection,
|
|
pub envs: HashMap<String, String>,
|
|
pub inner_content: &'a str,
|
|
pub job: &'a MiniPulledJob,
|
|
pub job_dir: &'a str,
|
|
pub mem_peak: &'a mut i32,
|
|
pub occupancy_metrics: &'a mut OccupancyMetrics,
|
|
pub requirements_o: Option<&'a String>,
|
|
pub shared_mount: &'a str,
|
|
pub worker_name: &'a str,
|
|
}
|
|
|
|
pub async fn handle_ruby_job<'a>(
|
|
mut args: JobHandlerInput<'a>,
|
|
) -> Result<Box<sqlx::types::JsonRawValue>, Error> {
|
|
// --- Prepare ---
|
|
{
|
|
prepare(&args).await?;
|
|
}
|
|
// --- Gen Lockfile ---
|
|
|
|
let lockfile = resolve(
|
|
&args.job.id,
|
|
args.inner_content,
|
|
args.mem_peak,
|
|
args.canceled_by,
|
|
args.job_dir,
|
|
args.conn,
|
|
args.worker_name,
|
|
&args.job.workspace_id,
|
|
)
|
|
.await?;
|
|
|
|
// --- Install ---
|
|
|
|
let ir = install(&mut args, lockfile).await?;
|
|
|
|
// --- Execute ---
|
|
{
|
|
run(&mut args, ir).await?;
|
|
}
|
|
// --- Retrieve results ---
|
|
{
|
|
read_result(&args.job_dir, None).await
|
|
}
|
|
}
|
|
pub async fn prepare<'a>(
|
|
JobHandlerInput {
|
|
job,
|
|
conn,
|
|
job_dir,
|
|
inner_content,
|
|
client,
|
|
//
|
|
..
|
|
}: &JobHandlerInput<'a>,
|
|
) -> Result<(), Error> {
|
|
create_args_and_out_file(&client, job, job_dir, conn).await?;
|
|
File::create(format!("{}/main.rb", job_dir))
|
|
.await?
|
|
.write_all(&wrap(inner_content)?.into_bytes())
|
|
.await?;
|
|
|
|
let mini_wm_path = format!("{}/gems/windmill-internal/windmill", *RUBY_CACHE_DIR);
|
|
if !std::fs::metadata(&mini_wm_path).is_ok() {
|
|
fs::create_dir_all(&mini_wm_path).await?;
|
|
|
|
// Create inline.rb for dependency management (bundler/inline compatibility)
|
|
File::create(format!("{}/inline.rb", &mini_wm_path))
|
|
.await?
|
|
.write_all(&wrap(
|
|
r#"
|
|
class GemfileProxy
|
|
def initialize
|
|
@gem_calls = []
|
|
end
|
|
|
|
def source(arg = nil, &block)
|
|
if arg.is_a?(String) && block_given?
|
|
# Handle the case where the argument is a string and a block is given
|
|
gemfile(&block)
|
|
elsif arg.is_a?(String)
|
|
# Handle the case where the argument is a string and no block is given
|
|
# Do nothing in this case
|
|
else
|
|
raise ArgumentError, "Invalid argument or block"
|
|
end
|
|
end
|
|
|
|
def group(*args, **kwargs)
|
|
# Handle group calls if needed
|
|
end
|
|
|
|
def ruby(*args, **kwargs)
|
|
warn "Custom Ruby runtime specifications (engine, engine_version, patchlevel) are not supported in this environment. Using system ruby"
|
|
end
|
|
|
|
def gem(name, version = nil, require: nil, **kwargs)
|
|
@gem_calls << { name: name, version: version, require: require, kwargs: kwargs }
|
|
|
|
case require
|
|
when false
|
|
# Skip requiring
|
|
when nil, true
|
|
begin
|
|
Kernel.require(name)
|
|
rescue LoadError => e
|
|
warn "WARN: Gem '#{name}' failed to auto-require. Try either:"
|
|
warn " `:require => false` or specify exact require path"
|
|
warn "Warn details: #{e.class}: #{e.message}"
|
|
end
|
|
else
|
|
begin
|
|
Kernel.require(require.to_s)
|
|
rescue LoadError => e
|
|
warn "WARN: Gem '#{name}' failed to auto-require. Try either:"
|
|
warn " `:require => false` or specify exact require path"
|
|
warn "Warn details: #{e.class}: #{e.message}"
|
|
end
|
|
end
|
|
end
|
|
|
|
|
|
def call_block(&block)
|
|
instance_eval(&block) if block_given?
|
|
end
|
|
end
|
|
|
|
def gemfile(&block)
|
|
proxy = GemfileProxy.new
|
|
proxy.call_block(&block)
|
|
end
|
|
|
|
def main
|
|
end
|
|
"#
|
|
)?.into_bytes())
|
|
.await?;
|
|
|
|
// Create mini.rb for Windmill client methods
|
|
File::create(format!("{}/mini.rb", &mini_wm_path))
|
|
.await?
|
|
.write_all(
|
|
&wrap(
|
|
r##"
|
|
require 'net/http'
|
|
require 'uri'
|
|
require 'json'
|
|
|
|
# Windmill mini client methods
|
|
def get_variable(path)
|
|
base_url = ENV['BASE_INTERNAL_URL']
|
|
workspace = ENV['WM_WORKSPACE']
|
|
token = ENV['WM_TOKEN']
|
|
|
|
uri = URI("#{base_url}/api/w/#{workspace}/variables/get_value/#{path}")
|
|
|
|
http = Net::HTTP.new(uri.host, uri.port)
|
|
http.use_ssl = uri.scheme == 'https'
|
|
|
|
request = Net::HTTP::Get.new(uri)
|
|
request['Authorization'] = "Bearer #{token}"
|
|
|
|
response = http.request(request)
|
|
|
|
if response.code == '200'
|
|
JSON.parse(response.body)
|
|
else
|
|
raise "Failed to get variable #{path}: #{response.code} #{response.message}"
|
|
end
|
|
end
|
|
|
|
def get_resource(path)
|
|
base_url = ENV['BASE_INTERNAL_URL']
|
|
workspace = ENV['WM_WORKSPACE']
|
|
token = ENV['WM_TOKEN']
|
|
|
|
uri = URI("#{base_url}/api/w/#{workspace}/resources/get_value_interpolated/#{path}")
|
|
|
|
http = Net::HTTP.new(uri.host, uri.port)
|
|
http.use_ssl = uri.scheme == 'https'
|
|
|
|
request = Net::HTTP::Get.new(uri)
|
|
request['Authorization'] = "Bearer #{token}"
|
|
|
|
response = http.request(request)
|
|
|
|
if response.code == '200'
|
|
JSON.parse(response.body)
|
|
else
|
|
raise "Failed to get resource #{path}: #{response.code} #{response.message}"
|
|
end
|
|
end
|
|
|
|
def main
|
|
end
|
|
"##,
|
|
)?
|
|
.into_bytes(),
|
|
)
|
|
.await?;
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn resolve<'a>(
|
|
job_id: &Uuid,
|
|
inner_content: &str,
|
|
mem_peak: &mut i32,
|
|
canceled_by: &mut Option<CanceledBy>,
|
|
job_dir: &str,
|
|
conn: &Connection,
|
|
worker_name: &str,
|
|
w_id: &str,
|
|
) -> Result<String, Error> {
|
|
lazy_static::lazy_static! {
|
|
static ref BUNDLER_RE: Regex = Regex::new(r#"(?m)^\s*require\s*['"]bundler/inline['"]"#).unwrap();
|
|
static ref UNSUPPORTED_SOURCE_RE: Regex = Regex::new(r#"(?m)(?<src>^\s*source\s*['"]\S+://(?<usr>\S+):(?<passwd>\S+)@.*['"]\s*\n)"#).unwrap();
|
|
static ref SOURCES_RE: Regex = Regex::new(r#"\S+://(?<creds>\S+:\S+)@(?<url>\S*)"#).unwrap();
|
|
}
|
|
|
|
if BUNDLER_RE.find(&inner_content).is_some() {
|
|
return Err(anyhow!(
|
|
"Detected `require 'bundler/inline'` - please replace with `require 'windmill/inline'`.
|
|
Your Gemfile syntax will continue to work as-is."
|
|
)
|
|
.into());
|
|
}
|
|
|
|
let gemfile: String = windmill_parser_ruby::parse_ruby_requirements(&inner_content)?
|
|
.lines()
|
|
.map(str::trim)
|
|
.filter(|s| !s.is_empty() && !s.starts_with('#'))
|
|
.join("\n");
|
|
|
|
if let Some(caps) = UNSUPPORTED_SOURCE_RE.captures(&gemfile) {
|
|
if let (Some(src_m), Some(usr_m), Some(passwd_m)) =
|
|
(caps.name("src"), caps.name("usr"), caps.name("passwd"))
|
|
{
|
|
let cause = src_m
|
|
.as_str()
|
|
.replace(usr_m.as_str(), "REDACTED")
|
|
.replace(passwd_m.as_str(), "REDACTED");
|
|
|
|
return Err(anyhow!("!> {cause} - inline source credentials are not supported at the moment. Please set up credentials in instance settings, if you do not have access to it, contact your administrator. If you need this feature please let us know.").into());
|
|
}
|
|
}
|
|
|
|
let mut file = File::create(job_dir.to_owned() + "/Gemfile").await?;
|
|
file.write_all(&gemfile.as_bytes()).await?;
|
|
|
|
let ws_suffix = crate::workspace_registry_cache_suffix(w_id).await;
|
|
let req_hash = format!("ruby-{}{ws_suffix}", calculate_hash(&gemfile));
|
|
if let Some(db) = conn.as_sql() {
|
|
if let Some(cached) = sqlx::query_scalar!(
|
|
"SELECT lockfile FROM pip_resolution_cache WHERE hash = $1",
|
|
req_hash
|
|
)
|
|
.fetch_optional(db)
|
|
.await?
|
|
{
|
|
return Ok(cached);
|
|
}
|
|
}
|
|
let lock = {
|
|
append_logs(
|
|
job_id,
|
|
w_id,
|
|
format!("\n--- RESOLVING LOCKFILE ---\n"),
|
|
conn,
|
|
)
|
|
.await;
|
|
|
|
let mut cmd = if !cfg!(windows) && is_sandboxing_enabled() {
|
|
let nsjail_proto = format!("{}.lock.config.proto", Uuid::new_v4());
|
|
let _ = write_file(
|
|
&job_dir,
|
|
&nsjail_proto,
|
|
&NSJAIL_CONFIG_LOCK_RUBY_CONTENT
|
|
.replace("{JOB_DIR}", job_dir)
|
|
.replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
|
|
.replace("{TRACING_PROXY_CA_CERT_PATH}", &*TRACING_PROXY_CA_CERT_PATH)
|
|
.replace("#{DEV}", DEV_CONF_NSJAIL), // .replace("{BUILD}", &build_dir),
|
|
)?;
|
|
let mut cmd = Command::new(NSJAIL_PATH.as_str());
|
|
cmd.args(vec!["--config", &nsjail_proto, "--", BUNDLE_PATH.as_str()]);
|
|
cmd
|
|
} else if cfg!(windows) {
|
|
Command::new("bundle.bat")
|
|
} else {
|
|
Command::new(BUNDLE_PATH.as_str())
|
|
};
|
|
|
|
cmd.env_clear()
|
|
.current_dir(job_dir.to_owned())
|
|
.envs(vec![
|
|
("PATH".to_owned(), PATH_ENV.clone()),
|
|
// Make sure there is nothing written to actual home
|
|
// This way we keep everything clean, organized and maintable
|
|
("HOME".to_owned(), RUBY_CACHE_DIR.to_owned()),
|
|
])
|
|
.envs(RUBY_PROXY_ENVS.clone());
|
|
|
|
for repo in read_ee_registry_url_list_with_workspace_override(
|
|
RUBY_REPOS.read().await.clone(),
|
|
"ruby_repos",
|
|
"ruby repos",
|
|
job_id,
|
|
w_id,
|
|
conn,
|
|
)
|
|
.await
|
|
.unwrap_or_default()
|
|
{
|
|
if let (Some(url), usr, Some(passwd)) =
|
|
(repo.domain(), repo.username(), repo.password())
|
|
{
|
|
cmd.env(
|
|
format!(
|
|
"BUNDLE_{}",
|
|
url
|
|
// Align with bundlers' format. Example:
|
|
// BUNDLE_GEM1__EXAMPLE__COM
|
|
.replace(".", "__")
|
|
.to_uppercase()
|
|
// Remove trailing slashes
|
|
.replace("/", "")
|
|
),
|
|
// BUNDLE_GEM1__EXAMPLE__COM=admin:123
|
|
format!("{usr}:{passwd}"),
|
|
);
|
|
}
|
|
}
|
|
cmd.args(&["lock", "--retry", "2"])
|
|
.stdout(Stdio::piped())
|
|
.stderr(Stdio::piped());
|
|
|
|
#[cfg(windows)]
|
|
{
|
|
cmd.env("SystemRoot", crate::SYSTEM_ROOT.as_str())
|
|
.env("USERPROFILE", crate::USERPROFILE_ENV.as_str())
|
|
.env(
|
|
"TMP",
|
|
std::env::var("TMP").unwrap_or_else(|_| String::from("/tmp")),
|
|
);
|
|
}
|
|
let child = start_child_process(cmd, "bundle", false).await?;
|
|
|
|
handle_child::handle_child(
|
|
job_id,
|
|
conn,
|
|
mem_peak,
|
|
canceled_by,
|
|
child,
|
|
is_sandboxing_enabled(),
|
|
worker_name,
|
|
w_id,
|
|
"bundle",
|
|
None,
|
|
false,
|
|
&mut None,
|
|
// Some(&mut stdout),
|
|
None,
|
|
None,
|
|
)
|
|
.await?;
|
|
|
|
let path_lock = format!("{job_dir}/Gemfile.lock");
|
|
let mut file = File::open(path_lock).await?;
|
|
let mut req_content = "".to_string();
|
|
file.read_to_string(&mut req_content).await?;
|
|
req_content
|
|
};
|
|
|
|
if let Some(db) = conn.as_sql() {
|
|
sqlx::query!(
|
|
"INSERT INTO pip_resolution_cache (hash, lockfile, expiration) VALUES ($1, $2, now() + ('3 days')::interval) ON CONFLICT (hash) DO UPDATE SET lockfile = EXCLUDED.lockfile",
|
|
req_hash,
|
|
lock.clone(),
|
|
).fetch_optional(db).await?;
|
|
}
|
|
|
|
append_logs(job_id, w_id, format!("\n{}", &lock), conn).await;
|
|
Ok(lock)
|
|
}
|
|
|
|
struct InstallRes {
|
|
/// "/tmp/windmill/cache/ruby/gems/ab..xz-name-1.0.0/gems/name-1.0.0/lib:/tmp/windmill/..."
|
|
rubylib: String,
|
|
|
|
/// ["/tmp/windmill/cache/ruby/gems/ab..xz-name-1.0.0", "/tmp/windmill/..."]
|
|
top_level_paths: Vec<String>,
|
|
}
|
|
|
|
async fn install<'a>(
|
|
JobHandlerInput {
|
|
worker_name,
|
|
job,
|
|
conn,
|
|
job_dir,
|
|
inner_content,
|
|
envs,
|
|
client,
|
|
parent_runnable_path,
|
|
..
|
|
}: &mut JobHandlerInput<'a>,
|
|
lockfile: String,
|
|
) -> Result<InstallRes, Error> {
|
|
#[derive(Debug, Clone)]
|
|
enum CurrentSource {
|
|
GIT { remote: Option<String>, revision: Option<String> },
|
|
GEM { remote: Option<String> },
|
|
INIT,
|
|
}
|
|
|
|
#[derive(Debug, Clone)]
|
|
enum FinalSource {
|
|
#[allow(dead_code)]
|
|
GIT {
|
|
remote: String,
|
|
revision: String,
|
|
},
|
|
GEM {
|
|
remote: String,
|
|
},
|
|
}
|
|
|
|
#[derive(Clone, Debug)]
|
|
struct CustomPayload {
|
|
source: FinalSource,
|
|
version: String,
|
|
pkg: String,
|
|
}
|
|
|
|
let mut deps = vec![];
|
|
let mut last_source = CurrentSource::INIT;
|
|
'lock_lines: for line in lockfile.lines() {
|
|
// Trimed line
|
|
let tl = line.trim_start();
|
|
if tl.starts_with("GIT") {
|
|
last_source = CurrentSource::GIT { remote: None, revision: None };
|
|
continue 'lock_lines;
|
|
} else if tl.starts_with("GEM") {
|
|
last_source = CurrentSource::GEM { remote: None };
|
|
continue 'lock_lines;
|
|
}
|
|
|
|
const REMOTE: &str = "remote: ";
|
|
if line.contains(REMOTE) {
|
|
match &mut last_source {
|
|
CurrentSource::GIT { remote, .. } => remote.replace(tl.replace(REMOTE, "")),
|
|
CurrentSource::GEM { remote } => remote.replace(tl.replace(REMOTE, "")),
|
|
CurrentSource::INIT => return Err(Error::InternalErr("BUG on installation stage: detected initial enum variant at the stage it was not supposed to be at. Please report this issue.".to_owned())),
|
|
};
|
|
continue 'lock_lines;
|
|
}
|
|
|
|
const REVISION: &str = "revision: ";
|
|
if line.contains(REVISION) {
|
|
if let CurrentSource::GIT { revision, .. } = &mut last_source {
|
|
revision.replace(tl.replace(REVISION, ""));
|
|
}
|
|
continue 'lock_lines;
|
|
}
|
|
|
|
// Check on untrimed line
|
|
if !line.starts_with(" ") || line.starts_with(" ") {
|
|
// "1234" "123456"
|
|
// For example:
|
|
//
|
|
// GIT
|
|
// remote: https://github.com/rails/rails.git
|
|
// revision: 8cb4f8ceffe375f64052579cd7a580bfdaf36d61
|
|
// specs:
|
|
// actioncable (8.1.0.alpha)
|
|
// actionpack (= 8.1.0.alpha)
|
|
// activesupport (= 8.1.0.alpha)
|
|
// nio4r (~> 2.0)
|
|
// websocket-driver (>= 0.6.1)
|
|
// zeitwerk (~> 2.6)
|
|
// actionmailbox (8.1.0.alpha)
|
|
// actionpack (= 8.1.0.alpha)
|
|
// activejob (= 8.1.0.alpha)
|
|
// activerecord (= 8.1.0.alpha)
|
|
// activestorage (= 8.1.0.alpha)
|
|
// activesupport (= 8.1.0.alpha)
|
|
// mail (>= 2.8.0)
|
|
// actionmailer (8.1.0.alpha)
|
|
// ...
|
|
//
|
|
// In this snippet we only want actioncable, actionmailbox and actionmailer
|
|
//
|
|
// If it got the hit than that's not it, just skip
|
|
continue 'lock_lines;
|
|
}
|
|
|
|
let buf = tl.replace(['(', ')'], "");
|
|
let &[pkg, version, ..] = buf.split_whitespace().collect_vec().as_slice() else {
|
|
return Err(anyhow!("Cannot determine version and package name for: {}", tl).into());
|
|
};
|
|
|
|
// Strip platform from version. E.g:
|
|
// 1.18.9-x86_64-darwin -> 1.18.9
|
|
let version = version.split('-').next().unwrap_or(version);
|
|
|
|
let custom_payload = CustomPayload {
|
|
version: version.into(),
|
|
pkg: pkg.into(),
|
|
source: match last_source.clone() {
|
|
CurrentSource::GIT { remote, revision } => FinalSource::GIT {
|
|
remote: remote.unwrap_or_default(),
|
|
revision: revision.unwrap_or_default(),
|
|
},
|
|
CurrentSource::GEM { remote } => {
|
|
FinalSource::GEM { remote: remote.unwrap_or_default() }
|
|
},
|
|
CurrentSource::INIT => return Err(Error::InternalErr("BUG on installation stage: detected initial enum variant at the stage it was not supposed to be at. Please report this issue.".to_owned())),
|
|
},
|
|
};
|
|
|
|
// Calculate hash based on source
|
|
// Obfuscation is essential because remote can include credentials
|
|
let mut hash = calculate_hash(&format!("{:?}", custom_payload.clone()));
|
|
|
|
// Use 32 characters which is 256 bits
|
|
hash.truncate(32);
|
|
|
|
// Final format:
|
|
// 123...zx-activesupport-8.0.2
|
|
// ^^^^^^^^ hash based on source and type (GEM or GIT)
|
|
let handle = format!("{}-{}-{}", hash, pkg, version);
|
|
let path = format!("{}/gems/{}", *RUBY_CACHE_DIR, &handle);
|
|
|
|
deps.push(RequiredDependency {
|
|
path,
|
|
_s3_handle: handle,
|
|
display_name: tl.to_owned(),
|
|
custom_payload,
|
|
});
|
|
}
|
|
|
|
let job_dir = job_dir.to_owned();
|
|
let jailed = !cfg!(windows) && is_sandboxing_enabled();
|
|
let RubyAnnotations { verbose } = RubyAnnotations::parse(&inner_content);
|
|
let repos = read_ee_registry_url_list_with_workspace_override(
|
|
RUBY_REPOS.read().await.clone(),
|
|
"ruby_repos",
|
|
"ruby repos",
|
|
&job.id,
|
|
&job.workspace_id,
|
|
conn,
|
|
)
|
|
.await
|
|
.unwrap_or_default();
|
|
let (envs, reserved_variables) = (
|
|
envs.clone(),
|
|
get_reserved_variables(job, &client.token, conn, parent_runnable_path.clone()).await?,
|
|
);
|
|
let nsjail_tmpfs_size = resolve_nsjail_tmpfs_size_bytes().await;
|
|
par_install_language_dependencies_seq(
|
|
InstallDeps::Flat(deps.clone()),
|
|
"ruby",
|
|
"gem",
|
|
false,
|
|
*RUBY_CONCURRENT_DOWNLOADS,
|
|
// true,
|
|
// crate::common::InstallStrategy::Single(Arc::new(move |dependency| {
|
|
move |dependency| {
|
|
let mut cmd = if jailed {
|
|
std::fs::create_dir_all(&dependency.path)?;
|
|
let nsjail_proto = format!("{}.download.config.proto", Uuid::new_v4());
|
|
let _ = write_file(
|
|
&job_dir,
|
|
&nsjail_proto,
|
|
&NSJAIL_CONFIG_DOWNLOAD_RUBY_CONTENT
|
|
.replace("{TARGET}", &dependency.path)
|
|
.replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
|
|
.replace("{TRACING_PROXY_CA_CERT_PATH}", &*TRACING_PROXY_CA_CERT_PATH)
|
|
.replace("{NSJAIL_TMPFS_SIZE}", &nsjail_tmpfs_size)
|
|
.replace("#{DEV}", DEV_CONF_NSJAIL), // .replace("{BUILD}", &build_dir),
|
|
)?;
|
|
let mut cmd = Command::new(NSJAIL_PATH.as_str());
|
|
cmd.args(vec!["--config", &nsjail_proto, "--", GEM_PATH.as_str()]);
|
|
cmd
|
|
} else {
|
|
Command::new(if cfg!(windows) {
|
|
"gem.cmd"
|
|
} else {
|
|
GEM_PATH.as_str()
|
|
})
|
|
};
|
|
cmd.env_clear()
|
|
.current_dir(&job_dir)
|
|
.envs(vec![
|
|
("PATH".to_owned(), PATH_ENV.clone()),
|
|
// Make sure there is nothing written to actual home
|
|
// This way we keep everything clean, organized and maintable
|
|
("HOME".to_owned(), RUBY_CACHE_DIR.to_owned()),
|
|
])
|
|
.envs(RUBY_PROXY_ENVS.clone());
|
|
|
|
// Figure out source
|
|
let source = {
|
|
let source = match dependency.custom_payload.source {
|
|
FinalSource::GIT { .. } => return Err(anyhow!("GIT is not supported").into()),
|
|
FinalSource::GEM { remote } => remote,
|
|
}
|
|
.trim()
|
|
.to_owned();
|
|
|
|
let src_url = Url::parse(&source)?;
|
|
repos
|
|
.iter()
|
|
.find(|inst_url| {
|
|
inst_url.domain().is_some()
|
|
&& (inst_url.domain(), inst_url.path())
|
|
== (src_url.domain(), src_url.path())
|
|
})
|
|
.map(Url::to_string)
|
|
.unwrap_or(source)
|
|
};
|
|
|
|
cmd.args(&[
|
|
"install",
|
|
&dependency.custom_payload.pkg,
|
|
"--version",
|
|
&dependency.custom_payload.version,
|
|
"--install-dir",
|
|
&dependency.path,
|
|
// Disable transitive dependencies!
|
|
"--ignore-dependencies",
|
|
"--no-document",
|
|
// Do not use default sources
|
|
"--clear-sources",
|
|
// Specify the one from lockfile
|
|
"--source",
|
|
source.as_str(),
|
|
])
|
|
.envs(envs.clone())
|
|
.envs(reserved_variables.clone())
|
|
.stdout(Stdio::piped())
|
|
.stderr(Stdio::piped());
|
|
|
|
if !verbose {
|
|
// Make it output minimal info
|
|
cmd.args(&["--quiet", "--silent"]);
|
|
}
|
|
|
|
#[cfg(windows)]
|
|
{
|
|
cmd.env("SystemRoot", crate::SYSTEM_ROOT.as_str())
|
|
.env("USERPROFILE", crate::USERPROFILE_ENV.as_str())
|
|
.env(
|
|
"TMP",
|
|
std::env::var("TMP").unwrap_or_else(|_| String::from("/tmp")),
|
|
)
|
|
.env(
|
|
"SYSTEMDRIVE",
|
|
std::env::var("SYSTEMDRIVE").unwrap_or_else(|_| String::from("C:")),
|
|
);
|
|
}
|
|
|
|
Ok(cmd)
|
|
},
|
|
None,
|
|
&job.id,
|
|
&job.workspace_id,
|
|
worker_name,
|
|
jailed,
|
|
conn,
|
|
)
|
|
.await?;
|
|
|
|
let mut res = InstallRes {
|
|
rubylib: deps
|
|
.iter()
|
|
.map(|rd| {
|
|
format!(
|
|
"{}/gems/{}-{}/lib",
|
|
rd.path, rd.custom_payload.pkg, rd.custom_payload.version
|
|
)
|
|
})
|
|
.join(":"),
|
|
top_level_paths: deps.iter().map(|rd| rd.path.clone()).collect_vec(),
|
|
};
|
|
// Include builtin windmill client
|
|
{
|
|
let wm_internal = format!("{}/gems/windmill-internal", *RUBY_CACHE_DIR);
|
|
res.top_level_paths.push(wm_internal.clone());
|
|
res.rubylib += format!(":{wm_internal}").as_str();
|
|
}
|
|
Ok(res)
|
|
}
|
|
|
|
async fn run<'a>(
|
|
JobHandlerInput {
|
|
occupancy_metrics,
|
|
mem_peak,
|
|
canceled_by,
|
|
worker_name,
|
|
job,
|
|
conn,
|
|
job_dir,
|
|
shared_mount,
|
|
client,
|
|
envs,
|
|
base_internal_url,
|
|
parent_runnable_path,
|
|
..
|
|
}: &mut JobHandlerInput<'a>,
|
|
InstallRes { rubylib, top_level_paths }: InstallRes,
|
|
) -> Result<(), Error> {
|
|
let reserved_variables =
|
|
get_reserved_variables(job, &client.token, conn, parent_runnable_path.clone()).await?;
|
|
|
|
let child = if !cfg!(windows) && is_sandboxing_enabled() {
|
|
append_logs(
|
|
&job.id,
|
|
&job.workspace_id,
|
|
format!("\n--- ISOLATED RUBY CODE EXECUTION ---\n"),
|
|
conn,
|
|
)
|
|
.await;
|
|
let shared_deps = top_level_paths
|
|
.into_iter()
|
|
.map(|pp| {
|
|
format!(
|
|
r#"
|
|
mount {{
|
|
src: "{pp}"
|
|
dst: "{pp}"
|
|
is_bind: true
|
|
rw: false
|
|
}}
|
|
"#
|
|
)
|
|
})
|
|
.join("\n");
|
|
|
|
let nsjail_timeout =
|
|
resolve_nsjail_timeout(conn, &job.workspace_id, job.id, job.timeout).await;
|
|
write_file(
|
|
job_dir,
|
|
"run.config.proto",
|
|
&NSJAIL_CONFIG_RUN_RUBY_CONTENT
|
|
.replace("{JOB_DIR}", job_dir)
|
|
.replace("{SHARED_MOUNT}", &shared_mount)
|
|
.replace("{SHARED_DEPENDENCIES}", &shared_deps)
|
|
.replace("{TRACING_PROXY_CA_CERT_PATH}", &*TRACING_PROXY_CA_CERT_PATH)
|
|
.replace("#{DEV}", DEV_CONF_NSJAIL)
|
|
.replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
|
|
.replace("{NSJAIL_TMPFS_SIZE}", &resolve_nsjail_tmpfs_size_bytes().await)
|
|
.replace("{TIMEOUT}", &nsjail_timeout),
|
|
)?;
|
|
let mut cmd = Command::new(NSJAIL_PATH.as_str());
|
|
cmd.env_clear()
|
|
.current_dir(job_dir)
|
|
.env("PATH", PATH_ENV.as_str())
|
|
.env("BASE_INTERNAL_URL", base_internal_url)
|
|
.env("RUBYLIB", rubylib.as_str())
|
|
.envs(envs)
|
|
.envs(reserved_variables)
|
|
.envs(RUBY_PROXY_ENVS.clone())
|
|
.envs(
|
|
get_proxy_envs_for_lang(
|
|
&ScriptLang::Ruby,
|
|
job.kind,
|
|
&job.id,
|
|
&job.workspace_id,
|
|
conn,
|
|
)
|
|
.await?,
|
|
)
|
|
.args(vec![
|
|
"--config",
|
|
"run.config.proto",
|
|
"--",
|
|
RUBY_PATH.as_str(),
|
|
"main.rb",
|
|
]);
|
|
cmd.stdout(Stdio::piped()).stderr(Stdio::piped());
|
|
|
|
start_child_process(cmd, NSJAIL_PATH.as_str(), false).await?
|
|
} else {
|
|
append_logs(
|
|
&job.id,
|
|
&job.workspace_id,
|
|
format!("\n--- RUBY CODE EXECUTION ---\n"),
|
|
conn,
|
|
)
|
|
.await;
|
|
|
|
let ruby_executable = if cfg!(windows) {
|
|
"ruby.exe"
|
|
} else {
|
|
RUBY_PATH.as_str()
|
|
};
|
|
|
|
let args = vec!["main.rb"];
|
|
let mut cmd = build_command_with_isolation(ruby_executable, &args);
|
|
|
|
#[cfg(windows)]
|
|
let rubylib = rubylib.replace(":", ";");
|
|
|
|
cmd.env_clear()
|
|
.current_dir(job_dir.to_owned())
|
|
.env("PATH", PATH_ENV.as_str())
|
|
.env("RUBYLIB", rubylib.as_str())
|
|
.env("BASE_INTERNAL_URL", base_internal_url)
|
|
.envs(reserved_variables)
|
|
.envs(RUBY_PROXY_ENVS.clone())
|
|
.envs(
|
|
get_proxy_envs_for_lang(
|
|
&ScriptLang::Ruby,
|
|
job.kind,
|
|
&job.id,
|
|
&job.workspace_id,
|
|
conn,
|
|
)
|
|
.await?,
|
|
)
|
|
.envs(envs);
|
|
|
|
cmd.stdin(Stdio::null())
|
|
.stdout(Stdio::piped())
|
|
.stderr(Stdio::piped());
|
|
|
|
#[cfg(windows)]
|
|
{
|
|
cmd.env("SystemRoot", crate::SYSTEM_ROOT.as_str())
|
|
.env("USERPROFILE", crate::USERPROFILE_ENV.as_str())
|
|
.env(
|
|
"TMP",
|
|
std::env::var("TMP").unwrap_or_else(|_| String::from("/tmp")),
|
|
);
|
|
}
|
|
start_child_process(cmd, ruby_executable, false).await?
|
|
};
|
|
handle_child::handle_child(
|
|
&job.id,
|
|
conn,
|
|
mem_peak,
|
|
canceled_by,
|
|
child,
|
|
is_sandboxing_enabled(),
|
|
worker_name,
|
|
&job.workspace_id,
|
|
"ruby",
|
|
job.timeout,
|
|
false,
|
|
&mut Some(occupancy_metrics),
|
|
None,
|
|
None,
|
|
)
|
|
.await?;
|
|
Ok(())
|
|
}
|
|
fn wrap(inner_content: &str) -> Result<String, Error> {
|
|
let sig = parse_ruby_signature(inner_content)?;
|
|
let spread = sig
|
|
.args
|
|
.clone()
|
|
.into_iter()
|
|
.map(|Arg { name, .. }| format!("a[\"{}\"]", name))
|
|
.collect_vec()
|
|
.join(",");
|
|
Ok(
|
|
r#"INNER_CONTENT
|
|
|
|
require 'json'
|
|
a = JSON.parse(File.read("args.json"))
|
|
|
|
begin
|
|
res = main(SPREAD)
|
|
File.open("result.json", "w") do |file|
|
|
file.write(JSON.generate(res))
|
|
end
|
|
|
|
rescue => e
|
|
error = {
|
|
name: e.class.name,
|
|
stack: e.full_message,
|
|
message: e.message
|
|
}
|
|
File.open("result.json", "w") do |file|
|
|
file.write(JSON.generate(error))
|
|
end
|
|
raise
|
|
end
|
|
"#
|
|
.replace("INNER_CONTENT", inner_content)
|
|
.replace("SPREAD", &spread), // .replace("TRANSFORM", transform)
|
|
)
|
|
}
|