mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-12 00:06:14 +00:00

Files

T

Ruben FiszelandClaude Opus 4.8 fd54cc694d fix(security): sandbox the PowerShell module install step under nsjail

The PowerShell module-install step ran `pwsh -Command <install_string>` directly
via start_child_process with no nsjail wrapping, unlike the run step which gates
on is_sandboxing_enabled(). Defense-in-depth: wrap the install step in nsjail
when sandboxing is enabled, using a dedicated install proto modeled on
run.powershell.config.proto but with the module cache mounted rw (so
Save-PSResource can still populate it) and the per-job script/result mounts
dropped.

Smoke-tested locally: nsjail starts, pwsh runs inside the jail (jailed /proc/1),
and writes to the rw cache mount succeed. NOT yet validated end-to-end is module
download from PSGallery / a private repo through the cloud tracing proxy — hence
draft.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-15 17:03:52 +00:00

nsjail

fix(security): sandbox the PowerShell module install step under nsjail

2026-06-15 17:03:52 +00:00

src

fix(security): sandbox the PowerShell module install step under nsjail

2026-06-15 17:03:52 +00:00

build.rs

refactor: isolate deno_core into windmill-runtime-nativets subcrate (#7848 )

2026-02-08 09:16:37 +00:00

Cargo.toml

fix: actually isolate windows job children from CTRL_BREAK_EVENT + reap on worker death (#9563 )