mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-20 16:02:19 +00:00

Files

T

Ruben Fiszel f8467f38c8 fix: prevent cross-tenant DNS poisoning via writable /etc in nsjail (#9194 )

* fix: bind /etc resolver files read-only in nsjail sandboxes

* docs(nsjail): explain why per-file /etc resolver binds are load-bearing

The explicit /etc/hosts, /etc/resolv.conf and /etc/hostname binds look
like removable duplication of the read-only /etc bind above them. They
are not: on Kubernetes those files are separate kubelet bind-mounts on
top of /etc and nsjail's read-only remount is non-recursive, so without
these shadow binds they stay writable and a job can persist cross-tenant
DNS poisoning for the pod lifetime. Comment guards against a future
"dedup cleanup" silently reintroducing the vulnerability.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(nsjail): shorten the load-bearing-bind comment to 3 lines

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

2026-05-17 12:54:38 +00:00

nsjail

fix: prevent cross-tenant DNS poisoning via writable /etc in nsjail (#9194 )

2026-05-17 12:54:38 +00:00

src

fix: atomic bundle cache writes to prevent parallel cold-load race (#9186 )

2026-05-15 21:04:16 +00:00

build.rs

refactor: isolate deno_core into windmill-runtime-nativets subcrate (#7848 )

2026-02-08 09:16:37 +00:00

Cargo.toml

refactor: move ai providers to windmill-ai (#9120 )