chore(worker): remove sandboxed execution mode requirement for worker groups - #15022
Conversation
Worker groups no longer refuse to start when AP_EXECUTION_MODE is not a process-sandboxed mode. The AP_REUSE_SANDBOX explicit-set requirement for grouped workers is unchanged.
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| packages/server/worker/src/lib/worker.ts | Restricts the grouped-worker process-sandbox validation to cloud edition while preserving explicit AP_REUSE_SANDBOX validation. |
| packages/server/worker/test/lib/worker-settings-override.test.ts | Covers unsandboxed enterprise workers, cloud rejection and acceptance cases, and the missing reuse-setting failure. |
| docs/install/configure-operate/worker-groups.mdx | Updates the worker-group configuration example so AP_EXECUTION_MODE is no longer presented as universally required. |
Reviews (2): Last reviewed commit: "restore worker group sandboxed execution..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| Grouped workers must set: | ||
|
|
||
| ```bash | ||
| AP_EXECUTION_MODE=SANDBOX_PROCESS # or SANDBOX_CODE_AND_PROCESS | ||
| AP_REUSE_SANDBOX=true # or false, must be set explicitly | ||
| ``` |
There was a problem hiding this comment.
The updated setup allows grouped workers to use the default UNSANDBOXED mode without explaining that it is intended for trusted environments. Because these workers process assigned projects' flow and webhook runs, add a warning and link to the existing sandboxing guide so operators do not unintentionally run tenant-authored automation without process isolation.
Knowledge Base Used: Workers and execution sandboxing
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
1 participant
Description
Workers with
AP_WORKER_GROUP_IDset previously refused to start unless the effectiveAP_EXECUTION_MODEwasSANDBOX_PROCESSorSANDBOX_CODE_AND_PROCESS(thrown infetchAndStoreSettingsinpackages/server/worker/src/lib/worker.ts), on every edition. This scopes that requirement to the cloud edition only (EDITIONfrom the server-provided worker settings): self-hosted CE/EE grouped workers can now run in any execution mode, while cloud grouped workers keep the process-sandboxed enforcement.Unchanged: grouped workers still require
AP_REUSE_SANDBOXto be set explicitly, on all editions.Docs updated:
docs/install/configure-operate/worker-groups.mdx(self-hosting docs) no longer listsAP_EXECUTION_MODE=SANDBOX_PROCESSas required.How was this tested?
Updated
worker-settings-override.test.ts: worker group +UNSANDBOXEDpasses on EE, throws on cloud; worker group +SANDBOX_PROCESSpasses on cloud; missingAP_REUSE_SANDBOXstill throws. Note: most worker test files (including untouched ones) currently fail at import time on a pre-existing evlog ESM/CJS issue in theserver-utilsdist, unrelated to this change.Fixes # (issue)
Breaking change? (required — CI fails if this is left unedited)
Security impact? (required — CI fails if this is left unedited)
🤖 Generated with Claude Code