mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-21 16:02:28 +00:00

Files

T

Ruben Fiszel 17872018cc feat(nsjail): make python/ansible rlimit_as configurable per worker (GIT-921) (#10138 )

nsjail caps a jailed job's virtual address space at rlimit_as (4096 MiB for
python3 and ansible). JIT runtimes (Bun/JavaScriptCore, the JVM) reserve large
virtual ranges up front, so a subprocess spawned from a jailed Python/Ansible
job can crash against this cap even when its physical memory use is modest
(e.g. the Bun-compiled claude CLI hitting JSC/pthread allocation failures).

Most other language protos already run with disable_rl: true (unlimited);
python3 and ansible are the outliers with an explicit rlimit_as. This exposes
that cap via a per-language env var (NSJAIL_PY_RLIMIT_AS_MB,
NSJAIL_ANSIBLE_RLIMIT_AS_MB) so operators can raise or lift it on a dedicated
worker pool without a source patch/rebuild and without weakening the
mount/PID/user-namespace isolation that provides the real security boundary.
Only the address-space limit changes; cpu/fsize/nofile rlimits are untouched.

Value is in MiB, or unlimited/none/inf/0 to uncap (rlimit_as_type: INF). Unset
keeps the historical 4096 default.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-15 17:52:39 +02:00

nsjail

feat(nsjail): make python/ansible rlimit_as configurable per worker (GIT-921) (#10138 )

2026-07-15 17:52:39 +02:00

src

feat(nsjail): make python/ansible rlimit_as configurable per worker (GIT-921) (#10138 )

2026-07-15 17:52:39 +02:00

build.rs

refactor: isolate deno_core into windmill-runtime-nativets subcrate (#7848 )

2026-02-08 09:16:37 +00:00

Cargo.toml

perf: eliminate dual-connection DB pool contention across worker, queue, and api (#9798 )