Files
windmill/backend/windmill-duckdb-ffi-internal/build_dev.sh
T
f9513e82ee feat: run duckdb jobs out of process under job isolation, drop the engine fork, bump to 1.5.6 (#11780)
* feat: prototype running duckdb jobs out of process inside nsjail

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: bound runner output, honor force install outside the jail, set oom score before exec

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: gate the duckdb runner bin behind a feature and decode pre-install errors

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: allowlist-only policy inside the duckdb jail, with its own extension cache

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: run duckdb jobs out of process under job isolation and drop the engine fork

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: runner everywhere, stock duckdb engine, no sql fence

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: update ee-repo-ref to 24bdc6615b3f651141fb740e2cacf9c3c2d81252

This commit updates the EE repository reference after PR #884 was merged in windmill-ee-private.

Previous ee-repo-ref: 73452bbc280cc9ca33cf0fe325d26c2fbf3aace4

New ee-repo-ref: 24bdc6615b3f651141fb740e2cacf9c3c2d81252

Automated by sync-ee-ref workflow.

* fix: pass the windows system env and TZ to the duckdb runner

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: cap a jailed duckdb job's disk use from the worker, 6GiB by default on cloud

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: keep a disk-backed jail tmp under the duckdb disk cap

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: drop the benchmark scaffolding and bump duckdb to 1.5.6

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
2026-10-15 16:49:50 +02:00

52 lines
2.7 KiB
Bash
Executable File

#!/usr/bin/env bash
set -euo pipefail
cd "$(dirname "$0")"
# The `duckdb` "bundled" feature compiles the whole DuckDB C++ library from
# source (~minutes) and dominates this crate's build. The crate changes very
# rarely, so by default build into a per-user cache shared across worktrees and
# keyed by the dependency lock: a fresh worktree reuses the already-compiled
# DuckDB instead of rebuilding it, and distinct DuckDB versions don't collide.
# Override the cache root with WINDMILL_DUCKDB_FFI_TARGET.
#
# If you are actively editing this crate in a worktree, uncommitted changes to
# its source switch to an isolated per-worktree ./target so your incremental
# builds neither disturb nor are disturbed by the shared cache.
src_dirty="$(git status --porcelain -- src Cargo.toml Cargo.lock build.rs 2>/dev/null || true)"
if [ -n "${CARGO_TARGET_DIR:-}" ]; then
# A caller that pinned the output dir wins over both: CI pins it so its cache
# step finds the artifacts and a following `cargo test` reuses this compile
# instead of building the bundled DuckDB a second time.
echo "duckdb-ffi: caller-pinned target $CARGO_TARGET_DIR"
elif [ -n "$src_dirty" ]; then
export CARGO_TARGET_DIR="$PWD/target"
echo "duckdb-ffi: local crate changes detected -> isolated target $CARGO_TARGET_DIR"
else
cache_root="${WINDMILL_DUCKDB_FFI_TARGET:-${XDG_CACHE_HOME:-$HOME/.cache}/windmill/duckdb-ffi-target}"
if command -v sha256sum >/dev/null 2>&1; then hash_cmd=sha256sum; else hash_cmd="shasum -a 256"; fi
key="$(cat Cargo.lock build.rs | $hash_cmd | cut -c1-16)"
export CARGO_TARGET_DIR="$cache_root/$key"
echo "duckdb-ffi: shared cache $CARGO_TARGET_DIR"
# The cache key covers only the dependency inputs (Cargo.lock + build.rs), so
# the expensive bundled-DuckDB build is shared even when this crate's own
# source differs between checkouts. But the shared dir's runner binary is a
# single fixed-name artifact written by whichever worktree built last. Touch
# our sources so cargo re-links THIS checkout's runner and re-uplifts it
# before we copy — the copied artifact then always matches this worktree,
# never a sibling's. The bundled dependency is a separate crate and stays
# cached, so this only costs a ~1s relink.
find src -type f -exec touch {} +
fi
cargo build --release -p windmill_duckdb_ffi_internal
mkdir -p ../target/debug/
# The worker looks for the runner next to its own binary. Install through a rename rather
# than writing over the destination: a runner may be executing, and rewriting its pages under
# it kills the process with SIGBUS. A rename swaps the directory entry and leaves the old
# inode alone.
dest="../target/debug/windmill_duckdb_runner"
cp "$CARGO_TARGET_DIR/release/windmill_duckdb_runner" "$dest.tmp"
mv -f "$dest.tmp" "$dest"