kalugin66/windmill
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

apply iptables for cloud hosted only

Browse Source
This commit is contained in:
Ruben Fiszel
2025-07-13 20:08:04 +00:00
parent 0f2e2502d0
commit 39917bc157
2 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
backend/src/main.rs
View File

@@ -58,7 +58,7 @@ use windmill_common::{
Mode, GIT_VERSION, HOSTNAME, MODE_AND_ADDONS,
},
worker::{
reload_custom_tags_setting, Connection, HUB_CACHE_DIR, TMP_DIR, TMP_LOGS_DIR, WORKER_GROUP,
reload_custom_tags_setting, Connection, CLOUD_HOSTED, HUB_CACHE_DIR, TMP_DIR, TMP_LOGS_DIR, WORKER_GROUP
},
KillpillSender, METRICS_ENABLED,
};
@@ -268,6 +268,21 @@ async fn windmill_main() -> anyhow::Result<()> {
tracing::error!("Failed to install rustls crypto provider");
}
#[cfg(feature = "enterprise")]
if *CLOUD_HOSTED {
// Block access to AWS/GCP metadata endpoints for security in cloud-hosted mode.
// This is a best-effort attempt; if it fails, just warn and continue.
if let Err(e) = std::process::Command::new("sh")
.arg("-c")
.arg("iptables -A OUTPUT -d 169.254.169.254 -j DROP && iptables -A FORWARD -d 169.254.169.254 -j DROP")
.status()
{
tracing::warn!("Failed to run iptables to block metadata endpoint: {e}");
} else {
tracing::info!("Successfully blocked metadata endpoint using iptables");
}
}
let hostname = HOSTNAME.to_owned();
let mode_and_addons = MODE_AND_ADDONS.clone();

1
docker/DockerfileNsjail
View File

@@ -72,7 +72,6 @@ RUN /usr/bin/java -jar /usr/bin/coursier about
# iptables
RUN apt-get install -y iptables
RUN iptables -A OUTPUT -d 169.254.169.254 -j DROP && iptables -A FORWARD -d 169.254.169.254 -j DROP
COPY --from=nsjail /nsjail/nsjail /bin/nsjail