mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-11 16:09:39 +00:00

Files

T

Ruben FiszelandClaude Opus 4.8 6269b1e86f docs(worker): note world-readable /proc (cmdline/args) exposure of docker jobs

The per-job-podman bind-mount escape can read world-readable host state — including
world-readable /proc (process cmdlines/args via `-v /proc`), other job dirs'
world-readable files, and the dep cache — but NOT 0400 files like /proc/<pid>/environ
(env secrets stay protected on a root worker). Document this in the security notes
(README + compose + code comment) with the corollary: don't pass secrets as
command-line args (windmill uses env). Verified: uid-1000 container via `-v /proc`
reading a root process's environ -> 'Permission denied'; its cmdline -> readable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-05 01:48:57 +00:00

nsjail

feat(worker): confine docker containers to the job under nsjail

2026-06-04 09:39:34 +00:00

src

docs(worker): note world-readable /proc (cmdline/args) exposure of docker jobs

2026-06-05 01:48:57 +00:00

build.rs

refactor: isolate deno_core into windmill-runtime-nativets subcrate (#7848 )

2026-02-08 09:16:37 +00:00

Cargo.toml

feat(worker): drop per-job podman to non-root when worker is root (protect /proc env)