Ruben FiszelandClaude Opus 5.5 69d36f77da feat: probe nsjail with a real jail and add a gVisor compat mode (#11865) ...

* feat: probe nsjail with a real jail and add a gVisor compat mode

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: route dbt captured phases through the gVisor compat step and harden the probe dir

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: patch nsjail with a gvisor_compat option instead of applying rlimits from the worker

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: keep DuckDB jailed on a sandboxed worker whose nsjail probe failed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: link the upstream gVisor issues from the nsjail patch

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-19 01:33:35 +02:00

..

ai

feat: route dev workspace and fork jobs to their own worker groups (#11811)

2026-10-16 18:47:41 +02:00

agent_workers.rs

feat: put a data table's connection under Postgres roles (#11020)

2026-09-18 13:56:41 +02:00

ai_executor.rs

feat: let a linked agent step override model and reasoning effort (#11685)

2026-10-14 10:23:56 +02:00

ansible_executor.rs

feat: ingest dbt column lineage and real column schemas from the engine's parquet index (#10977)

2026-09-08 09:58:38 +02:00

bash_executor.rs

feat: add a no_network annotation for sandboxed jobs (#11844)

2026-10-17 09:25:55 +00:00

bigquery_executor.rs

fix: heartbeat job ping during s3object materialization in SQL executors (#10152)

2026-07-16 15:48:11 +02:00

bun_executor.rs

gate unix-only bun staging items for the Windows worker build (#11856)

2026-10-18 02:47:24 +00:00

common.rs

feat: probe nsjail with a real jail and add a gVisor compat mode (#11865)

2026-10-19 01:33:35 +02:00

config.rs

feat: replace ephemeral tokens by jwt (#3908)

2024-06-14 13:07:35 +02:00

csharp_executor.rs

fix(worker): keep script env vars off the nsjail launcher process (#11749)

2026-10-14 10:14:46 +02:00

dbt_column_index.rs

feat: make snowflake_oauth work as a dbt warehouse on every engine (#11095)

2026-09-12 00:00:17 +02:00

dbt_engine.rs

feat(dbt): reach any dbt adapter through a dbt_profile resource, and constrain the warehouse picker (#10525)

2026-08-05 00:34:26 +02:00

dbt_executor.rs

feat: probe nsjail with a real jail and add a gVisor compat mode (#11865)

2026-10-19 01:33:35 +02:00

dbt_profiles.rs

feat: make snowflake_oauth work as a dbt warehouse on every engine (#11095)

2026-09-12 00:00:17 +02:00

dbt_state.rs

feat: durable dbt state per environment, and --defer onto it (#10975)

2026-09-08 08:32:30 +02:00

dedicated_worker_oss.rs

feat: flow for loop squashing (#7107)

2025-11-25 17:25:34 +01:00

deno_executor.rs

feat: stop offering deno for new scripts, ship it only on full images (#11648)

2026-10-09 19:15:08 +02:00

docker_v2.rs

feat: add a no_network annotation for sandboxed jobs (#11844)

2026-10-17 09:25:55 +00:00

duckdb_executor.rs

feat: run duckdb jobs out of process under job isolation, drop the engine fork, bump to 1.5.6 (#11780)

2026-10-15 16:49:50 +02:00

duckdb_runner.rs

feat: probe nsjail with a real jail and add a gVisor compat mode (#11865)

2026-10-19 01:33:35 +02:00

global_cache.rs

fix(worker): bound cache transfers and import fetches in bun jobs (#11138)

2026-09-15 13:02:44 +02:00

go_executor.rs

fix(worker): keep script env vars off the nsjail launcher process (#11749)

2026-10-14 10:14:46 +02:00

graphql_executor.rs

improve graphql error reporting (#6092)

2025-07-01 15:45:04 +02:00

handle_child.rs

feat: per-script resource rollup and heaviest scripts table (#11631)

2026-10-09 15:23:18 +02:00

java_executor.rs

fix(worker): keep script env vars off the nsjail launcher process (#11749)

2026-10-14 10:14:46 +02:00

job_logger_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

job_logger.rs

fix: return result.json and stdout results from sandboxed containers (#10460)

2026-08-03 12:35:12 +02:00

js_eval.rs

fix: retry js eval up to 3 times on timeout from slow DB (#7890)

2026-02-10 17:50:41 +00:00

lib.rs

feat: probe nsjail with a real jail and add a gVisor compat mode (#11865)

2026-10-19 01:33:35 +02:00

memory_common.rs

feat(ai-agent): add compaction memory that summarizes older context (#10928)

2026-09-29 19:01:53 +02:00

memory_oss.rs

feat(ai-agent): add compaction memory that summarizes older context (#10928)

2026-09-29 19:01:53 +02:00

mssql_executor.rs

fix: reject out-of-range integer args to narrow SQL types instead of wrapping (#11864)

2026-10-18 12:27:06 +02:00

mysql_executor.rs

fix: heartbeat job ping during s3object materialization in SQL executors (#10152)

2026-07-16 15:48:11 +02:00

nsjail_compat.rs

feat: probe nsjail with a real jail and add a gVisor compat mode (#11865)

2026-10-19 01:33:35 +02:00

nu_executor.rs

fix(worker): keep script env vars off the nsjail launcher process (#11749)

2026-10-14 10:14:46 +02:00

oracledb_executor.rs

fix: track dollar-quoted strings in SQL block splitter (#8891)

2026-04-21 17:07:01 +00:00

otel_oss.rs

feat(otel): connect jobs to the inbound distributed trace (#9456)

2026-06-05 16:50:07 +00:00

otel_tracing_proxy_oss.rs

feat: add otlp/http internal collector (#7690)

2026-01-26 19:29:09 +00:00

pg_executor.rs

fix: reject out-of-range integer args to narrow SQL types instead of wrapping (#11864)

2026-10-18 12:27:06 +02:00

pg_raw_output.rs

fix: bound postgres result collection so an oversized result cannot OOM the worker (#10644)

2026-08-12 09:11:56 +02:00

php_executor.rs

fix(worker): keep script env vars off the nsjail launcher process (#11749)

2026-10-14 10:14:46 +02:00

prepare_deps.rs

chore: pass --system-certs to uv instead of the deprecated --native-tls (#11666)

2026-10-13 14:59:23 +00:00

pwsh_executor.rs

fix(security): sanitize dependency names & connection strings against command/SQL injection (#9590)

2026-06-15 19:06:00 +02:00

python_executor.rs

fix: mount python script modules into the nsjail sandbox (#11846)

2026-10-17 09:26:21 +00:00

python_versions.rs

feat: record each instance's python version and start new ones on 3.13 (#11656)

2026-10-13 15:22:07 +00:00

r_executor.rs

feat: add a no_network annotation for sandboxed jobs (#11844)

2026-10-17 09:25:55 +00:00

resource_metrics.rs

feat: export worker cpu, memory and occupancy metrics (#11629)

2026-10-08 22:17:44 +02:00

result_processor.rs

feat: per-script resource rollup and heaviest scripts table (#11631)

2026-10-09 15:23:18 +02:00

ruby_executor.rs

fix(worker): keep script env vars off the nsjail launcher process (#11749)

2026-10-14 10:14:46 +02:00

rust_executor.rs

fix(worker): keep script env vars off the nsjail launcher process (#11749)

2026-10-14 10:14:46 +02:00

sanitized_sql_params.rs

feat: add support for contextual vars in SQL (#6791)

2025-10-10 18:52:24 +00:00

schema.rs

fix: parse Python datetime.datetime and datetime.date type annotations (#7856)

2026-02-09 15:17:26 +00:00

snowflake_executor.rs

feat: support array arguments in snowflake scripts (#11702)

2026-10-12 17:28:05 +00:00

sql_s3_input.rs

fix: bound s3 ai attachment downloads before encoding (#11534)

2026-10-05 14:50:03 +00:00

sql_utils.rs

Nit better test and comment (#8030)

2026-02-20 12:06:05 +00:00

ssh_executor_oss.rs

feat(worker): #ssh directive to run a bash script on a remote SSH host (#9479)

2026-06-10 15:14:37 +00:00

universal_pkg_installer.rs

feat: let a worker group override the dependency cache object store (#11019)

2026-09-08 14:10:51 +02:00

volume_oss.rs

feat: add sandbox annotations, volume mounts, for AI sandbox starting with claude (#8058)

2026-03-05 06:19:51 +00:00

wac_executor.rs

fix: store a WAC parent's first start and wall duration (#11625)

2026-10-08 18:05:37 +02:00

worker_flow.rs

feat: route dev workspace and fork jobs to their own worker groups (#11811)

2026-10-16 18:47:41 +02:00

worker_lockfiles.rs

fix: relock apps in place so imported script changes reach them (#11789)

2026-10-15 16:27:41 +02:00

worker_utils.rs

feat: export worker cpu, memory and occupancy metrics (#11629)

2026-10-08 22:17:44 +02:00

worker.rs

feat: probe nsjail with a real jail and add a gVisor compat mode (#11865)

2026-10-19 01:33:35 +02:00