kalugin66/windmill
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add force_sandboxing global setting and #sandbox bash annotation (#7816)

Browse Source 
* feat: add force_sandboxing global setting and #sandbox bash annotation

Add a new global setting `force_sandboxing` to enable nsjail sandboxing
for all jobs, overriding the DISABLE_NSJAIL environment variable.
Also add a #sandbox annotation for bash scripts to enable sandboxing
on a per-script basis.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: decouple nsjail probing from DISABLE_NSJAIL and apply force_sandboxing to all executors

NSJAIL_AVAILABLE now always probes for the nsjail binary at startup
regardless of the DISABLE_NSJAIL policy flag, fixing #sandbox annotation
and force_sandboxing being unusable in default (DISABLE_NSJAIL=true)
configuration. All language executors now use is_sandboxing_enabled()
instead of checking DISABLE_NSJAIL directly, so force_sandboxing
applies to all job types, not just bash.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: clarify force_sandboxing and DISABLE_NSJAIL relationship

Neither setting overrides the other — sandboxing is enabled when either
force_sandboxing=true OR DISABLE_NSJAIL=false. Updated frontend
description and backend comments to reflect this.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* all

* all

* revert typo

* all

* all

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Ruben Fiszel
2026-02-12 19:20:22 +01:00
committed by GitHub
parent d07934f82c
commit 2646629194
78 changed files with 340 additions and 273 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
backend/windmill-worker/src/java_executor.rs
View File

@@ -26,7 +26,7 @@ use crate::{
},
handle_child,
universal_pkg_installer::{par_install_language_dependencies_all_at_once, RequiredDependency},
COURSIER_CACHE_DIR, DISABLE_NSJAIL, DISABLE_NUSER, JAVA_CACHE_DIR, JAVA_HOME_DIR,
is_sandboxing_enabled, COURSIER_CACHE_DIR, DISABLE_NUSER, JAVA_CACHE_DIR, JAVA_HOME_DIR,
JAVA_REPOSITORY_DIR, MAVEN_REPOS, NO_DEFAULT_MAVEN, NSJAIL_PATH, PATH_ENV, PROXY_ENVS,
};
use windmill_common::client::AuthedClient;
@@ -420,7 +420,7 @@ async fn install<'a>(
&job.id,
&job.workspace_id,
worker_name,
!*DISABLE_NSJAIL,
is_sandboxing_enabled(),
conn,
)
.await?;
@@ -529,7 +529,7 @@ async fn compile<'a>(
mem_peak,
canceled_by,
child,
!*DISABLE_NSJAIL,
is_sandboxing_enabled(),
worker_name,
&job.workspace_id,
"javac",
@@ -585,7 +585,7 @@ async fn run<'a>(
let reserved_variables =
get_reserved_variables(job, &client.token, conn, parent_runnable_path.clone()).await?;
let child = if !cfg!(windows) && !*DISABLE_NSJAIL {
let child = if !cfg!(windows) && is_sandboxing_enabled() {
append_logs(
&job.id,
&job.workspace_id,
@@ -717,7 +717,7 @@ async fn run<'a>(
mem_peak,
canceled_by,
child,
!*DISABLE_NSJAIL,
is_sandboxing_enabled(),
worker_name,
&job.workspace_id,
"java",