mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-27 16:02:43 +00:00
feb7b1ad90
* feat: add a no_network annotation for sandboxed python, bash, bun and r jobs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep nodejs relative imports and dedicated workers working under no_network Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bundle bun no_network jobs so relative imports resolve before the run Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: point ee-repo-ref at the runner group no_network fix Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: state the no_network token rule once Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: refuse no_network jobs whose workspace imports would be fetched at run time Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let type-only workspace imports through the no_network import check Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to ca4a1959a0d2257d413a57349939053ac3473c6b This commit updates the EE repository reference after PR #895 was merged in windmill-ee-private. Previous ee-repo-ref: 3841923cfd117b6b907ac3e84b26f07bde41f8ed New ee-repo-ref: ca4a1959a0d2257d413a57349939053ac3473c6b Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
164 lines
2.2 KiB
Protocol Buffer
164 lines
2.2 KiB
Protocol Buffer
name: "bash run script"
|
|
|
|
mode: ONCE
|
|
hostname: "bash"
|
|
log_level: ERROR
|
|
time_limit: {TIMEOUT}
|
|
|
|
disable_rl: true
|
|
|
|
cwd: "/tmp"
|
|
|
|
clone_newnet: {CLONE_NEWNET}
|
|
clone_newuser: {CLONE_NEWUSER}
|
|
|
|
skip_setsid: true
|
|
keep_caps: false
|
|
keep_env: true
|
|
mount_proc: true
|
|
|
|
mount {
|
|
src: "/bin"
|
|
dst: "/bin"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/proc/self/fd"
|
|
dst: "/dev/fd"
|
|
is_symlink: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/opt/microsoft"
|
|
dst: "/opt/microsoft"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/lib"
|
|
dst: "/lib"
|
|
is_bind: true
|
|
}
|
|
|
|
|
|
mount {
|
|
src: "/lib64"
|
|
dst: "/lib64"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
|
|
mount {
|
|
src: "/usr"
|
|
dst: "/usr"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/null"
|
|
dst: "/dev/null"
|
|
is_bind: true
|
|
rw: true
|
|
}
|
|
|
|
|
|
|
|
|
|
{TMP_MOUNT_BLOCK}
|
|
|
|
mount {
|
|
src: "{JOB_DIR}/main.sh"
|
|
dst: "/tmp/main.sh"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "{JOB_DIR}/wrapper.sh"
|
|
dst: "/tmp/wrapper.sh"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/etc"
|
|
dst: "/etc"
|
|
is_bind: true
|
|
}
|
|
|
|
# Container runtimes bind exactly these 3 files as separate submounts over
|
|
# /etc; nsjail's ro remount of /etc is non-recursive so they stay writable.
|
|
# Load-bearing -- do not remove as redundant with the /etc bind above.
|
|
mount {
|
|
src: "/etc/resolv.conf"
|
|
dst: "/etc/resolv.conf"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/etc/hosts"
|
|
dst: "/etc/hosts"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/etc/hostname"
|
|
dst: "/etc/hostname"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/random"
|
|
dst: "/dev/random"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/urandom"
|
|
dst: "/dev/urandom"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "{JOB_DIR}/result.json"
|
|
dst: "/tmp/result.json"
|
|
rw: true
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "{JOB_DIR}/result.out"
|
|
dst: "/tmp/result.out"
|
|
rw: true
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "{JOB_DIR}/result2.out"
|
|
dst: "/tmp/result2.out"
|
|
rw: true
|
|
is_bind: true
|
|
}
|
|
|
|
iface_no_lo: true
|
|
|
|
{SHARED_MOUNT}
|
|
|
|
envar: "HOME=/tmp"
|
|
|
|
mount {
|
|
src: "{TRACING_PROXY_CA_CERT_PATH}"
|
|
dst: "{TRACING_PROXY_CA_CERT_PATH}"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
#{DEV}
|