mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-05 08:02:18 +00:00
Ruben FiszelandClaude Opus 4.8
e1856d30ec
When the docker worker runs as root (the default for compose/helm workers), start the per-job podman via `runuser` dropped to a non-root uid so it runs rootless. This keeps the worker's secrets in /proc/<worker>/environ (DATABASE_URL etc.) root-owned and therefore unreadable by a `docker run --pid=host` container, and makes a container escape land unprivileged — without the fragile namespace confinement (no unshare/mask/pid-ns, which conflicted with podman system service). A non-root worker can't drop further (podman runs rootless as itself; a --pid=host container shares its uid), so run the docker worker as root for the /proc protection. The per-job podman + its containers are spawned in a new process group so teardown and the storage-cap monitor kill the whole tree (podman is a runuser grandchild). This does NOT confine the container's filesystem view — a `# docker` script can still bind-mount worker-visible paths — so docker-capable workers remain a trusted-tenant capability (documented). Reverses the earlier `user: 1000` advice: keep the worker root; windmill drops podman itself. e2e verified (bare-metal, worker as root): stock docker job runs (dropped rootless podman); a uid-1000 --pid=host container reading the root worker's /proc/environ -> 'Permission denied' (DATABASE_URL/secret protected). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise