Skip to main content

Code Execution Sandbox

RAGFlow Agents can use the Code component to run Python or JavaScript. Before users can run code, an administrator must select and configure a sandbox provider.

The provider determines where the code runs. Depending on your choice, RAGFlow can send code to containers managed in your own environment, an existing SSH server, or a managed cloud sandbox.

System-wide setting

The active sandbox provider is a system-wide setting. Changing it affects subsequent Code component runs across the RAGFlow deployment. Test the new configuration before saving it.

For instructions on using the Code component after an administrator has configured a provider, see Code component.

Choose a sandbox provider

Choose the provider that matches where you want code to run and who should manage the execution environment.

ProviderWhere code runsChoose it when
Self-ManagedPython or Node.js Runner containers managed by Sandbox Executor Manager in your environmentYou want to keep code execution under your operational control. This is the default option and the focus of the Self-Managed guides.
SSHAn existing remote Linux hostYou already operate a suitable execution server with Python or Node.js and can manage its SSH access and host keys.
Aliyun Code InterpreterAlibaba Cloud Code InterpreterYour organization uses Alibaba Cloud and wants a managed execution environment.
E2BE2B cloud sandboxesYou want an externally managed cloud sandbox without operating local Runner containers.
TenkiA disposable Tenki microVM created for each executionYou want each run to use an isolated, short-lived cloud microVM.
UCloud Agent SandboxA disposable UCloud Agent SandboxYou want a managed cloud sandbox in a supported UCloud region.
Before choosing a cloud provider

Confirm that your RAGFlow deployment can reach the provider's API, and that your account has valid credentials, sufficient quota, and access to the required region.

For most private or on-premises deployments, start with Self-Managed. In the standard deployment:

  1. RAGFlow sends the execution request to Sandbox Executor Manager.
  2. Sandbox Executor Manager selects a Python or Node.js Runner container.
  3. The Runner executes the code and returns its output and generated files to RAGFlow.

RAGFlow can run with Docker Compose or directly from source while Sandbox Executor Manager and its Runners use Docker. Follow Quickstart with Self-Managed for both deployment patterns.

Next steps