mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-19 00:03:19 +00:00

Files

T

Ruben FiszelandClaude Opus 4.8 8483700f0e feat(worker): confine docker containers to the job under nsjail

Under nsjail (untrusted), a docker job now runs against its OWN rootless podman
instance instead of the shared per-worker service, so no container it spawns can
outlive the job — even extra/detached ones the script starts.

- start_per_job_podman(): per docker+nsjail job (when container_runtime=podman),
  start a rootless `podman system service` with isolated --root/--runroot under
  the job dir; its unix socket is bind-mounted into the jail ({DOCKER_SOCK_MOUNT}
  in run.bash.config.proto) and handed to the script as DOCKER_HOST.
- connect_docker()/handle_docker_job() take an optional per-job docker_host so
  bollard talks to the per-job socket.
- PerJobPodman Drop tears the instance down on every exit path (success, error,
  cancel, timeout, killpill): `podman rm -af --force` (removes ALL containers in
  the instance, not just $WM_JOB_ID — conmon reparents so process-tree kill is
  insufficient) + kill the service + remove the dir.
- unshare (trusted) keeps using the shared service unchanged.

Verified e2e on native rootless podman + nsjail: a job that detaches an extra
`sleep 600` container completes successfully and the extra container is killed
when the job ends (no leak). Tradeoff: per-job storage re-pulls images (no shared
cache yet); a shared read-only image store is a follow-up optimization.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-04 09:39:34 +00:00

nsjail

feat(worker): confine docker containers to the job under nsjail

2026-06-04 09:39:34 +00:00

src

feat(worker): confine docker containers to the job under nsjail

2026-06-04 09:39:34 +00:00

build.rs

refactor: isolate deno_core into windmill-runtime-nativets subcrate (#7848 )

2026-02-08 09:16:37 +00:00

Cargo.toml

feat(snowflake): derive public key from private key when omitted (WIN-1959) (#9251 )