windmill/backend/windmill-worker/nsjail/lock.ruby.config.proto

name: "bundle lock"

mode: ONCE
hostname: "ruby"
log_level: ERROR
time_limit: 900

rlimit_as: 2048
rlimit_cpu: 1000
rlimit_fsize: 1024
rlimit_nofile: 64

envar: "HOME=/tmp"
envar: "LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH"

cwd: "/tmp"

clone_newnet: false
clone_newuser: {CLONE_NEWUSER}

skip_setsid: true
keep_caps: true
keep_env: true
mount_proc: true


mount {
    src: "/bin"
    dst: "/bin"
	is_bind: true
}

mount {
    src: "/lib"
    dst: "/lib"
	is_bind: true
}

mount {
    src: "/lib64"
    dst: "/lib64"
	is_bind: true
    mandatory: false
}

mount {
    src: "/usr"
    dst: "/usr"
	is_bind: true
}

mount {
    src: "/etc"
    dst: "/etc"
	is_bind: true
}

mount {
	src: "/dev/null"
	dst: "/dev/null"
	is_bind: true
	rw: true
}

mount {
    src: "{JOB_DIR}"
    dst: "/tmp"
    is_bind: true
    mandatory: false
    rw: true
}

mount {
    src: "/dev/urandom"
    dst: "/dev/urandom"
    is_bind: true
}

{DEV}