windmill/backend/windmill-worker/nsjail/run.ruby.config.proto

name: "ruby run script"

mode: ONCE
hostname: "ruby"
log_level: ERROR

disable_rl: true

cwd: "/tmp"

clone_newnet: false
clone_newuser: {CLONE_NEWUSER}

skip_setsid: true
keep_caps: false
keep_env: true
# mount_proc: true

mount {
    src: "/bin"
    dst: "/bin"
    is_bind: true
}

mount {
    src: "/lib"
    dst: "/lib"
    is_bind: true
}


mount {
    src: "/lib64"
    dst: "/lib64"
    is_bind: true
    mandatory: false
}


mount {
    src: "/usr"
    dst: "/usr"
    is_bind: true
}

mount {
    src: "/dev/null"
    dst: "/dev/null"
    is_bind: true
    rw: true
}

mount {
    dst: "/tmp"
    fstype: "tmpfs"
    rw: true
    options: "size=500000000"
}


mount {
    src: "{JOB_DIR}/main.rb"
    dst: "/tmp/main.rb"
    is_bind: true
    mandatory: false
}

mount {
    src: "{JOB_DIR}/args.json"
    dst: "/tmp/args.json"
    is_bind: true
}

mount {
    src: "{JOB_DIR}/result.json"
    dst: "/tmp/result.json"
    rw: true
    is_bind: true
}

#mount {
#    src: "{CACHE_DIR}"
#    dst: "{CACHE_DIR}"
#    is_bind: true
#    mandatory: false
# }

mount {
    src: "/etc"
    dst: "/etc"
    is_bind: true
}

mount {
    src: "/dev/random"
    dst: "/dev/random"
    is_bind: true
}

mount {
    src: "/dev/urandom"
    dst: "/dev/urandom"
    is_bind: true
}

iface_no_lo: true

{SHARED_MOUNT}

{SHARED_DEPENDENCIES}


{DEV}