mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-20 16:03:21 +00:00
Ruben FiszelandClaude Opus 4.8
cd1930c06a
Enabling nsjail is an explicit 'fully sandbox jobs' signal, but the per-job podman daemon runs OUTSIDE the jail and a # docker script can bind-mount worker-visible paths through it — silently providing it under nsjail would be a surprising hole in a setup the operator hardened on purpose. So refuse instead: under nsjail, a # docker job with no explicitly-provided Docker daemon errors with guidance to use DOCKER_HOST (a network-reachable daemon; a mounted unix socket isn't reachable in the jail) or a non-nsjail worker group. nsjail is off by default (DISABLE_NSJAIL defaults true → default workers use unshare/none), so docker-via-podman keeps working out of the box; this only gates the explicit-nsjail case. Docs updated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise