mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-12 08:05:44 +00:00

Files

T

Ruben FiszelandClaude Opus 4.8 f61cf1633b refactor(worker): per-job podman for all docker jobs, drop the shared service

Generalize the per-job rootless podman instance to every docker job (any sandbox
mode) instead of only nsjail, and remove the long-lived shared service:

- Drop start_container_runtime_maybe() + its worker-startup call + the global
  DOCKER_HOST mutation. Each docker job now spins up its own ephemeral per-job
  podman (start_per_job_podman) and tears it down at job end — so no container
  outlives any job, and there's no standing shared socket on the worker.
- per_job_podman is gated strictly on container_runtime=podman. The legacy path
  (externally-provided DOCKER_HOST or a mounted /var/run/docker.sock, without
  container_runtime=podman) is unchanged: connect_docker(None)/forwarded env,
  and Windmill only manages the $WM_JOB_ID container as before.
- docker_host handed to the script: the in-jail /tmp/podman.sock under nsjail
  (bind-mounted), else the per-job host socket directly (unshare/none).
- The "no Docker daemon reachable" hint no longer fires when
  container_runtime=podman (per-job provides the daemon).
- monitor: drop the container_runtime killpill — with no startup service the
  config is read live per job, no worker restart needed on change.

Verified e2e against rootless podman: docker jobs work + confine extra containers
under nsjail AND unshare; legacy host-socket jobs run against the host daemon
with no per-job podman and extras persisting (unchanged).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-04 14:11:20 +00:00

nsjail

feat(worker): confine docker containers to the job under nsjail

2026-06-04 09:39:34 +00:00

src

refactor(worker): per-job podman for all docker jobs, drop the shared service

2026-06-04 14:11:20 +00:00

build.rs

refactor: isolate deno_core into windmill-runtime-nativets subcrate (#7848 )

2026-02-08 09:16:37 +00:00

Cargo.toml

feat(snowflake): derive public key from private key when omitted (WIN-1959) (#9251 )