mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-26 16:02:36 +00:00
Alexander PetricandClaude Opus 5.5
65c078d2a0
Set `keep_caps: false` in the python, ruby and R dependency install/lock profiles, matching the run profiles, and build the uv argument list in `download_deps.py.sh` directly instead of through a command string. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
112 lines
1.7 KiB
Protocol Buffer
112 lines
1.7 KiB
Protocol Buffer
name: "bundle lock"
|
|
|
|
mode: ONCE
|
|
hostname: "ruby"
|
|
log_level: ERROR
|
|
time_limit: 900
|
|
|
|
rlimit_as: 2048
|
|
rlimit_cpu: 1000
|
|
rlimit_fsize: 1024
|
|
rlimit_nofile: 64
|
|
|
|
envar: "HOME=/tmp"
|
|
envar: "LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH"
|
|
|
|
cwd: "/tmp"
|
|
|
|
clone_newnet: false
|
|
clone_newuser: {CLONE_NEWUSER}
|
|
|
|
skip_setsid: true
|
|
# No capability needed: writes go to the rw-mounted dirs as the jail's own uid, like the run.* profiles.
|
|
keep_caps: false
|
|
keep_env: true
|
|
mount_proc: true
|
|
|
|
|
|
mount {
|
|
src: "/bin"
|
|
dst: "/bin"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/lib"
|
|
dst: "/lib"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/lib64"
|
|
dst: "/lib64"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/usr"
|
|
dst: "/usr"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/etc"
|
|
dst: "/etc"
|
|
is_bind: true
|
|
}
|
|
|
|
# Container runtimes bind exactly these 3 files as separate submounts over
|
|
# /etc; nsjail's ro remount of /etc is non-recursive so they stay writable.
|
|
# Load-bearing -- do not remove as redundant with the /etc bind above.
|
|
mount {
|
|
src: "/etc/resolv.conf"
|
|
dst: "/etc/resolv.conf"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/etc/hosts"
|
|
dst: "/etc/hosts"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/etc/hostname"
|
|
dst: "/etc/hostname"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/null"
|
|
dst: "/dev/null"
|
|
is_bind: true
|
|
rw: true
|
|
}
|
|
|
|
mount {
|
|
src: "{JOB_DIR}"
|
|
dst: "/tmp"
|
|
is_bind: true
|
|
mandatory: false
|
|
rw: true
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/urandom"
|
|
dst: "/dev/urandom"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "{TRACING_PROXY_CA_CERT_PATH}"
|
|
dst: "{TRACING_PROXY_CA_CERT_PATH}"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
#{DEV}
|