mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-23 08:03:33 +00:00
* feat: prototype running duckdb jobs out of process inside nsjail Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bound runner output, honor force install outside the jail, set oom score before exec Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: gate the duckdb runner bin behind a feature and decode pre-install errors Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: allowlist-only policy inside the duckdb jail, with its own extension cache Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: run duckdb jobs out of process under job isolation and drop the engine fork Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: runner everywhere, stock duckdb engine, no sql fence Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 24bdc6615b3f651141fb740e2cacf9c3c2d81252 This commit updates the EE repository reference after PR #884 was merged in windmill-ee-private. Previous ee-repo-ref: 73452bbc280cc9ca33cf0fe325d26c2fbf3aace4 New ee-repo-ref: 24bdc6615b3f651141fb740e2cacf9c3c2d81252 Automated by sync-ee-ref workflow. * fix: pass the windows system env and TZ to the duckdb runner Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: cap a jailed duckdb job's disk use from the worker, 6GiB by default on cloud Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep a disk-backed jail tmp under the duckdb disk cap Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: drop the benchmark scaffolding and bump duckdb to 1.5.6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
52 lines
2.7 KiB
Bash
Executable File
52 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
|
|
# The `duckdb` "bundled" feature compiles the whole DuckDB C++ library from
|
|
# source (~minutes) and dominates this crate's build. The crate changes very
|
|
# rarely, so by default build into a per-user cache shared across worktrees and
|
|
# keyed by the dependency lock: a fresh worktree reuses the already-compiled
|
|
# DuckDB instead of rebuilding it, and distinct DuckDB versions don't collide.
|
|
# Override the cache root with WINDMILL_DUCKDB_FFI_TARGET.
|
|
#
|
|
# If you are actively editing this crate in a worktree, uncommitted changes to
|
|
# its source switch to an isolated per-worktree ./target so your incremental
|
|
# builds neither disturb nor are disturbed by the shared cache.
|
|
|
|
src_dirty="$(git status --porcelain -- src Cargo.toml Cargo.lock build.rs 2>/dev/null || true)"
|
|
|
|
if [ -n "${CARGO_TARGET_DIR:-}" ]; then
|
|
# A caller that pinned the output dir wins over both: CI pins it so its cache
|
|
# step finds the artifacts and a following `cargo test` reuses this compile
|
|
# instead of building the bundled DuckDB a second time.
|
|
echo "duckdb-ffi: caller-pinned target $CARGO_TARGET_DIR"
|
|
elif [ -n "$src_dirty" ]; then
|
|
export CARGO_TARGET_DIR="$PWD/target"
|
|
echo "duckdb-ffi: local crate changes detected -> isolated target $CARGO_TARGET_DIR"
|
|
else
|
|
cache_root="${WINDMILL_DUCKDB_FFI_TARGET:-${XDG_CACHE_HOME:-$HOME/.cache}/windmill/duckdb-ffi-target}"
|
|
if command -v sha256sum >/dev/null 2>&1; then hash_cmd=sha256sum; else hash_cmd="shasum -a 256"; fi
|
|
key="$(cat Cargo.lock build.rs | $hash_cmd | cut -c1-16)"
|
|
export CARGO_TARGET_DIR="$cache_root/$key"
|
|
echo "duckdb-ffi: shared cache $CARGO_TARGET_DIR"
|
|
# The cache key covers only the dependency inputs (Cargo.lock + build.rs), so
|
|
# the expensive bundled-DuckDB build is shared even when this crate's own
|
|
# source differs between checkouts. But the shared dir's runner binary is a
|
|
# single fixed-name artifact written by whichever worktree built last. Touch
|
|
# our sources so cargo re-links THIS checkout's runner and re-uplifts it
|
|
# before we copy — the copied artifact then always matches this worktree,
|
|
# never a sibling's. The bundled dependency is a separate crate and stays
|
|
# cached, so this only costs a ~1s relink.
|
|
find src -type f -exec touch {} +
|
|
fi
|
|
|
|
cargo build --release -p windmill_duckdb_ffi_internal
|
|
mkdir -p ../target/debug/
|
|
# The worker looks for the runner next to its own binary. Install through a rename rather
|
|
# than writing over the destination: a runner may be executing, and rewriting its pages under
|
|
# it kills the process with SIGBUS. A rename swaps the directory entry and leaves the old
|
|
# inode alone.
|
|
dest="../target/debug/windmill_duckdb_runner"
|
|
cp "$CARGO_TARGET_DIR/release/windmill_duckdb_runner" "$dest.tmp"
|
|
mv -f "$dest.tmp" "$dest"
|