kalugin66/windmill
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: do not use unshare for init scripts (#7418)

Browse Source
This commit is contained in:
Alexander Petric
2025-12-19 14:36:51 -05:00
committed by GitHub
parent a86c4f2dd6
commit 1b37d8a2ab
2 changed files with 43 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
backend/windmill-worker/src/bash_executor.rs
View File

@@ -159,15 +159,18 @@ exit $exit_status
let _ = write_file(job_dir, "result.out", "")?;
let _ = write_file(job_dir, "result2.out", "")?;
let nsjail = !*DISABLE_NSJAIL
&& job
.runnable_path
.as_ref()
.map(|x| {
!x.starts_with(INIT_SCRIPT_PATH_PREFIX)
&& !x.starts_with(PERIODIC_SCRIPT_PATH_PREFIX)
})
.unwrap_or(true);
// Check if this is a regular job (not init or periodic script)
// Init/periodic scripts need full system access without isolation
let is_regular_job = job
.runnable_path
.as_ref()
.map(|x| {
!x.starts_with(INIT_SCRIPT_PATH_PREFIX)
&& !x.starts_with(PERIODIC_SCRIPT_PATH_PREFIX)
})
.unwrap_or(true);
let nsjail = !*DISABLE_NSJAIL && is_regular_job;
let child = if nsjail {
let _ = write_file(
job_dir,
@@ -200,10 +203,17 @@ exit $exit_status
} else {
let mut cmd_args = vec!["wrapper.sh"];
cmd_args.extend(&args);
let mut bash_cmd = build_command_with_isolation(
BIN_BASH.as_str(),
&cmd_args.iter().map(|s| s.as_ref()).collect::<Vec<&str>>(),
);
// Only apply unshare isolation for regular jobs, not init/periodic scripts
let mut bash_cmd = if is_regular_job {
build_command_with_isolation(
BIN_BASH.as_str(),
&cmd_args.iter().map(|s| s.as_ref()).collect::<Vec<&str>>(),
)
} else {
let mut cmd = Command::new(BIN_BASH.as_str());
cmd.args(&cmd_args);
cmd
};
bash_cmd
.current_dir(job_dir)
.env_clear()

30
backend/windmill-worker/src/pwsh_executor.rs
View File

@@ -487,15 +487,18 @@ $env:PSModulePath = \"{};$PSModulePathBackup\"",
let _ = write_file(job_dir, "result.out", "")?;
let _ = write_file(job_dir, "result2.out", "")?;
let nsjail = !*DISABLE_NSJAIL
&& job
.runnable_path
.as_ref()
.map(|x| {
!x.starts_with(INIT_SCRIPT_PATH_PREFIX)
&& !x.starts_with(PERIODIC_SCRIPT_PATH_PREFIX)
})
.unwrap_or(true);
// Check if this is a regular job (not init or periodic script)
// Init/periodic scripts need full system access without isolation
let is_regular_job = job
.runnable_path
.as_ref()
.map(|x| {
!x.starts_with(INIT_SCRIPT_PATH_PREFIX)
&& !x.starts_with(PERIODIC_SCRIPT_PATH_PREFIX)
})
.unwrap_or(true);
let nsjail = !*DISABLE_NSJAIL && is_regular_job;
let child = if nsjail {
let _ = write_file(
job_dir,
@@ -539,7 +542,14 @@ $env:PSModulePath = \"{};$PSModulePathBackup\"",
cmd_args = vec![r".\wrapper.ps1"];
}
let mut cmd = build_command_with_isolation(POWERSHELL_PATH.as_str(), &cmd_args);
// Only apply unshare isolation for regular jobs, not init/periodic scripts
let mut cmd = if is_regular_job {
build_command_with_isolation(POWERSHELL_PATH.as_str(), &cmd_args)
} else {
let mut c = Command::new(POWERSHELL_PATH.as_str());
c.args(&cmd_args);
c
};
cmd.current_dir(job_dir)
.env_clear()