windmill/backend/windmill-worker/nsjail/run.ansible.config.proto

name: "ansible run script"

mode: ONCE
hostname: "ansible"
log_level: ERROR
time_limit: {TIMEOUT}

rlimit_as: 4096
rlimit_cpu: 1000
rlimit_fsize: 1000
rlimit_nofile: 10000

cwd: "/tmp"

clone_newnet: false
clone_newuser: {CLONE_NEWUSER}

skip_setsid: true
keep_caps: false
keep_env: true
mount_proc: true

mount {
    src: "/bin"
    dst: "/bin"
    is_bind: true
}

mount {
    src: "/lib"
    dst: "/lib"
    is_bind: true
}


mount {
    src: "/lib64"
    dst: "/lib64"
    is_bind: true
    mandatory: false
}

mount {
    src: "/root/.local/share/uv/tools/ansible"
    dst: "/root/.local/share/uv/tools/ansible"
    is_bind: true
    mandatory: false
}

mount {
    src: "/usr"
    dst: "/usr"
    is_bind: true
}

mount {
    src: "/dev/null"
    dst: "/dev/null"
    is_bind: true
    rw: true
}

mount {
    dst: "/dev/shm"
    fstype: "tmpfs"
    rw: true
    is_bind: false
}

{TMP_MOUNT_BLOCK}

mount {
    src: "{JOB_DIR}/main.yml"
    dst: "/tmp/main.yml"
    is_bind: true
}

mount {
    src: "{JOB_DIR}/wrapper.sh"
    dst: "/tmp/wrapper.sh"
    is_bind: true
}

mount {
    src: "{JOB_DIR}/requirements.yml"
    dst: "/tmp/requirements.yml"
    is_bind: true
    mandatory: false
}

mount {
    src: "{JOB_DIR}/ansible.cfg"
    dst: "/tmp/ansible.cfg"
    is_bind: true
}

mount {
    src: "{JOB_DIR}/ansible_collections/"
    dst: "/tmp/ansible_collections/"
    is_bind: true
    mandatory: false
}

mount {
    src: "{JOB_DIR}/args.json"
    dst: "/tmp/args.json"
    is_bind: true
}

mount {
    src: "{JOB_DIR}/result.json"
    dst: "/tmp/result_nsjail_mount.json"
    rw: true
    is_bind: true
}

mount {
    src: "/etc"
    dst: "/etc"
	is_bind: true
}

# Container runtimes bind exactly these 3 files as separate submounts over
# /etc; nsjail's ro remount of /etc is non-recursive so they stay writable.
# Load-bearing -- do not remove as redundant with the /etc bind above.
mount {
    src: "/etc/resolv.conf"
    dst: "/etc/resolv.conf"
    is_bind: true
    mandatory: false
}

mount {
    src: "/etc/hosts"
    dst: "/etc/hosts"
    is_bind: true
    mandatory: false
}

mount {
    src: "/etc/hostname"
    dst: "/etc/hostname"
    is_bind: true
    mandatory: false
}

mount {
    src: "/dev/random"
    dst: "/dev/random"
    is_bind: true
}

mount {
    src: "/dev/urandom"
    dst: "/dev/urandom"
    is_bind: true
}

mount {
    src: "{PY_INSTALL_DIR}"
    dst: "{PY_INSTALL_DIR}"
    is_bind: true
}


{SHARED_MOUNT}

{SHARED_DEPENDENCIES}

{FILE_RESOURCES}

iface_no_lo: true

envar: "LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH"
envar: "PYTHONPATH={ADDITIONAL_PYTHON_PATHS}"
envar: "HOME=/tmp"
envar: "ANSIBLE_CONFIG=/tmp/ansible.cfg"