mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-18 16:02:10 +00:00
Ruben Fiszel
17872018cc
nsjail caps a jailed job's virtual address space at rlimit_as (4096 MiB for python3 and ansible). JIT runtimes (Bun/JavaScriptCore, the JVM) reserve large virtual ranges up front, so a subprocess spawned from a jailed Python/Ansible job can crash against this cap even when its physical memory use is modest (e.g. the Bun-compiled claude CLI hitting JSC/pthread allocation failures). Most other language protos already run with disable_rl: true (unlimited); python3 and ansible are the outliers with an explicit rlimit_as. This exposes that cap via a per-language env var (NSJAIL_PY_RLIMIT_AS_MB, NSJAIL_ANSIBLE_RLIMIT_AS_MB) so operators can raise or lift it on a dedicated worker pool without a source patch/rebuild and without weakening the mount/PID/user-namespace isolation that provides the real security boundary. Only the address-space limit changes; cpu/fsize/nofile rlimits are untouched. Value is in MiB, or unlimited/none/inf/0 to uncap (rlimit_as_type: INF). Unset keeps the historical 4096 default. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
179 lines
2.5 KiB
Protocol Buffer
179 lines
2.5 KiB
Protocol Buffer
name: "python run script"
|
|
|
|
mode: ONCE
|
|
hostname: "python"
|
|
log_level: ERROR
|
|
time_limit: {TIMEOUT}
|
|
|
|
{RLIMIT_AS}
|
|
rlimit_cpu: 1000
|
|
rlimit_fsize: 1000
|
|
rlimit_nofile: 10000
|
|
|
|
cwd: "/tmp"
|
|
|
|
clone_newnet: false
|
|
clone_newuser: {CLONE_NEWUSER}
|
|
|
|
skip_setsid: true
|
|
keep_caps: false
|
|
keep_env: true
|
|
mount_proc: true
|
|
|
|
mount {
|
|
src: "/bin"
|
|
dst: "/bin"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/lib"
|
|
dst: "/lib"
|
|
is_bind: true
|
|
}
|
|
|
|
|
|
mount {
|
|
src: "/lib64"
|
|
dst: "/lib64"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
|
|
mount {
|
|
src: "/usr"
|
|
dst: "/usr"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/null"
|
|
dst: "/dev/null"
|
|
is_bind: true
|
|
rw: true
|
|
}
|
|
|
|
{TMP_MOUNT_BLOCK}
|
|
|
|
mount {
|
|
src: "{JOB_DIR}/{MAIN}.py"
|
|
dst: "/tmp/{MAIN}.py"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "{JOB_DIR}/loader.py"
|
|
dst: "/tmp/loader.py"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "{JOB_DIR}/wrapper.py"
|
|
dst: "/tmp/wrapper.py"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "{JOB_DIR}/args.json"
|
|
dst: "/tmp/args.json"
|
|
is_bind: true
|
|
rw: true
|
|
}
|
|
|
|
mount {
|
|
src: "{JOB_DIR}/checkpoint.json"
|
|
dst: "/tmp/checkpoint.json"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "{JOB_DIR}/result.json"
|
|
dst: "/tmp/result.json"
|
|
rw: true
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/etc"
|
|
dst: "/etc"
|
|
is_bind: true
|
|
}
|
|
|
|
# Container runtimes bind exactly these 3 files as separate submounts over
|
|
# /etc; nsjail's ro remount of /etc is non-recursive so they stay writable.
|
|
# Load-bearing -- do not remove as redundant with the /etc bind above.
|
|
mount {
|
|
src: "/etc/resolv.conf"
|
|
dst: "/etc/resolv.conf"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/etc/hosts"
|
|
dst: "/etc/hosts"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/etc/hostname"
|
|
dst: "/etc/hostname"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
dst: "/dev/shm"
|
|
fstype: "tmpfs"
|
|
rw: true
|
|
is_bind: false
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/random"
|
|
dst: "/dev/random"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "{PY_INSTALL_DIR}"
|
|
dst: "{PY_INSTALL_DIR}"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/urandom"
|
|
dst: "/dev/urandom"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "{GLOBAL_SITE_PACKAGES}"
|
|
dst: "{GLOBAL_SITE_PACKAGES}"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
{SHARED_MOUNT}
|
|
|
|
{SHARED_DEPENDENCIES}
|
|
|
|
iface_no_lo: true
|
|
|
|
envar: "LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH"
|
|
envar: "PYTHONPATH={ADDITIONAL_PYTHON_PATHS}"
|
|
envar: "HOME=/tmp"
|
|
|
|
mount {
|
|
src: "{TRACING_PROXY_CA_CERT_PATH}"
|
|
dst: "{TRACING_PROXY_CA_CERT_PATH}"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
#{DEV}
|