From 500bba84b45a81624954c68040c143a616087ede Mon Sep 17 00:00:00 2001
From: uumas <gitcommit@uumas.fi>
Date: Thu, 26 Mar 2026 04:11:50 +0200
Subject: [PATCH] windmill: Run worker outside of pinp

---
 roles/windmill/tasks/main.yaml                | 44 ++++++++++++++-----
 .../templates/worker_entrypoint.sh.j2         | 27 ------------
 2 files changed, 32 insertions(+), 39 deletions(-)
 delete mode 100644 roles/windmill/templates/worker_entrypoint.sh.j2

diff --git a/roles/windmill/tasks/main.yaml b/roles/windmill/tasks/main.yaml
index d3e458f..a31f729 100644
--- a/roles/windmill/tasks/main.yaml
+++ b/roles/windmill/tasks/main.yaml
@@ -17,26 +17,46 @@
       DATABASE_URL_FILE: /run/secrets/postgres-url
       MODE: server
     service_additional_containers:
-      - name: worker
+      - name: worker-pinp
         image: quay.io/podman/stable:latest
         user: podman
-        entrypoint: /entrypoint.sh
+        command:
+          - podman
+          - system
+          - service
+          - --time
+          - "0"
+        mounts:
+          - type: volume
+            source: worker-pinp-containers
+            destination: /home/podman/.local/share/containers
+          - type: volume
+            source: worker-pinp-tmp
+            destination: /tmp/storage-run-1000
+          - type: volume
+            source: worker-pinp-run
+            destination: /tmp/storage-run-1000/podman
+      - name: worker
         mounts:
           - type: volume
             source: worker-logs
-            destination: /worker-logs
+            destination: /tmp/windmill/logs
           - type: volume
             source: worker-dependency-cache
-            destination: /worker-dependency-cache
-          - type: template
-            source: worker_entrypoint.sh.j2
-            destination: /entrypoint.sh
-            mode: "0755"
+            destination: /tmp/windmill/cache
           - type: volume
-            source: worker-containers
-            destination: /home/podman/.local/share/containers
-        publish_ports: []
-        env: {}
+            source: worker-pinp-run
+            destination: /run/podman
+            readonly: true
+        env:
+          DATABASE_URL_FILE: /run/secrets/postgres-url
+          DOCKER_HOST: unix:///run/podman/podman.sock
+          MODE: worker
+          WORKER_GROUP: default
+          ENABLE_UNSHARE_PID: "true"
+          UNSHARE_ISOLATION_FLAGS: "--user --map-root-user --pid --fork"
+        wants:
+          - windmill-worker-pinp.service
       - name: worker-native
         env:
           DATABASE_URL_FILE: /run/secrets/postgres-url
diff --git a/roles/windmill/templates/worker_entrypoint.sh.j2 b/roles/windmill/templates/worker_entrypoint.sh.j2
deleted file mode 100644
index 3bd2279..0000000
--- a/roles/windmill/templates/worker_entrypoint.sh.j2
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/bin/bash
-# {{ ansible_managed }}
-_term() {
-	echo "Received SIGTERM, stopping all containers"
-	kill "$child"
-}
-
-podman system service -t 0 &
-
-podman run \
-	--rm \
-	-v /run/secrets/postgres-url:/run/secrets/postgres-url:ro \
-	-e DATABASE_URL_FILE=/run/secrets/postgres-url \
-	-e MODE=worker \
-	-e WORKER_GROUP=default \
-	-e ENABLE_UNSHARE_PID="true" \
-	-e UNSHARE_ISOLATION_FLAGS="--user --map-root-user --pid --fork" \
-	-v /tmp/storage-run-1000/podman/podman.sock:/var/run/docker.sock \
-	-v /worker-logs:/tmp/windmill/logs \
-	-v /worker-dependency-cache:/tmp/windmill/cache \
-	--name worker \
-	--network host \
-	ghcr.io/windmill-labs/windmill:main &
-
-child=$!
-trap _term SIGTERM
-wait "$!"