fix: skip nsjail uidmap/gidmap when DISABLE_NUSER=true

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-15 17:47:44 +02:00
2 changed files with 4 additions and 11 deletions
--- a/backend/windmill-worker/nsjail/run.bun.config.proto
+++ b/backend/windmill-worker/nsjail/run.bun.config.proto
@@ -15,17 +15,7 @@ clone_newnet: false
 clone_newuser: {CLONE_NEWUSER}
 clone_newcgroup: false

-uidmap {
-    inside_id: "1000"
-    outside_id: ""
-    count: 1
-}
-
-gidmap {
-    inside_id: "1000"
-    outside_id: ""
-    count: 1
-}
+{UIDGIDMAP}

 skip_setsid: true
 keep_caps: false
--- a/backend/windmill-worker/src/bun_executor.rs
+++ b/backend/windmill-worker/src/bun_executor.rs
@@ -2079,6 +2079,9 @@ try {{
                .replace("{LANG}", if annotation.nodejs { "nodejs" } else { "bun" })
                .replace("{JOB_DIR}", job_dir)
                .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
+                .replace("{UIDGIDMAP}", if *DISABLE_NUSER { "" } else {
+                    "uidmap {\n    inside_id: \"1000\"\n    outside_id: \"\"\n    count: 1\n}\n\ngidmap {\n    inside_id: \"1000\"\n    outside_id: \"\"\n    count: 1\n}"
+                })
                .replace(
                    "{SHARED_MOUNT}",
                    &shared_mount.replace(