mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-16 16:03:14 +00:00
Ruben FiszelandClaude Opus 5.5
1c068f33e1
* fix(worker): keep script env vars off the nsjail launcher process Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(worker): keep script env off the ruby gem-install nsjail launcher Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(worker): keep script env off the unjailed javac compile step Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(worker): gate script_overrides on the executors that use it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
132 lines
1.9 KiB
Protocol Buffer
132 lines
1.9 KiB
Protocol Buffer
name: "java run script"
|
|
|
|
mode: ONCE
|
|
hostname: "java"
|
|
log_level: ERROR
|
|
time_limit: {TIMEOUT}
|
|
|
|
disable_rl: true
|
|
|
|
cwd: "/tmp"
|
|
|
|
clone_newnet: false
|
|
clone_newuser: {CLONE_NEWUSER}
|
|
|
|
skip_setsid: true
|
|
keep_caps: false
|
|
keep_env: true
|
|
# The script's env vars, proto-escaped. Set here rather than on the process that
|
|
# execs nsjail: the loader honours `LD_PRELOAD` before the jail exists.
|
|
{ENVARS}
|
|
mount_proc: true
|
|
|
|
mount {
|
|
src: "/bin"
|
|
dst: "/bin"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/lib"
|
|
dst: "/lib"
|
|
is_bind: true
|
|
}
|
|
|
|
|
|
mount {
|
|
src: "/lib64"
|
|
dst: "/lib64"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
|
|
mount {
|
|
src: "/usr"
|
|
dst: "/usr"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/null"
|
|
dst: "/dev/null"
|
|
is_bind: true
|
|
rw: true
|
|
}
|
|
|
|
{TMP_MOUNT_BLOCK}
|
|
|
|
|
|
mount {
|
|
src: "{JOB_DIR}/target"
|
|
dst: "/tmp/target"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "{JOB_DIR}/args.json"
|
|
dst: "/tmp/args.json"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "{JOB_DIR}/result.json"
|
|
dst: "/tmp/result.json"
|
|
rw: true
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "{CACHE_DIR}"
|
|
dst: "{CACHE_DIR}"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/etc"
|
|
dst: "/etc"
|
|
is_bind: true
|
|
}
|
|
|
|
# Container runtimes bind exactly these 3 files as separate submounts over
|
|
# /etc; nsjail's ro remount of /etc is non-recursive so they stay writable.
|
|
# Load-bearing -- do not remove as redundant with the /etc bind above.
|
|
mount {
|
|
src: "/etc/resolv.conf"
|
|
dst: "/etc/resolv.conf"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/etc/hosts"
|
|
dst: "/etc/hosts"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/etc/hostname"
|
|
dst: "/etc/hostname"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/random"
|
|
dst: "/dev/random"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/urandom"
|
|
dst: "/dev/urandom"
|
|
is_bind: true
|
|
}
|
|
|
|
iface_no_lo: true
|
|
|
|
{SHARED_MOUNT}
|