langgenius/dify-sandbox

How langgenius/dify-sandbox works

Dify-Sandbox is a multi-tenant service for executing submitted code in a restricted environment. Its main workflow accepts an authenticated run request, dispatches it to a language-specific execution path, captures process output and returns an execution result; the tree also shows dependency management and syscall sandboxing as separate capabilities. The sampled router and output-capture code support those boundaries, but the run controller and language-specific service/runner implementations were not sampled, so their internal call wiring is left unspecified.

Main entry points: server.go HTTP server · router.go Route setup · python Python runner · run_code.go Run service

Components 19

API and access

HTTP server internal/server/server.go
Route setup internal/controller/router.go
Auth and limits internal/middleware
Run controller internal/controller/run.go
Dependency endpoints internal/controller/base.go

Execution

Run service internal/service/run_code.go
Node.js service internal/service/nodejs.go
Python service internal/service/python.go
Node.js runner internal/core/runner/nodejs
Python runner internal/core/runner/python
Output capture internal/core/runner/output_capture.go
Run response internal/types/response.go

Sandbox security

Node.js seccomp internal/core/lib/nodejs/add_seccomp.go
Python seccomp internal/core/lib/python/add_seccomp.go
Syscall policy internal/core/lib/seccomp.go

Dependencies and config

Runtime config internal/static/config.go
Python library discovery internal/static/python_lib_discovery.go
Python dependencies internal/core/runner/python/dependencies

Other components

API client

Connections 14

API client → HTTP server: sends requests
HTTP server → Route setup: sets up routes
HTTP server → Runtime config: loads config
Route setup → Auth and limits: attaches middleware
Route setup → Run controller: dispatches run
Route setup → Dependency endpoints: registers endpoints
HTTP server → Python dependencies: prepares dependencies
Node.js runner → Node.js seccomp
Python runner → Python seccomp
Node.js seccomp → Syscall policy
Python seccomp → Syscall policy
Python runner → Python library discovery
Output capture → Run service: provides output channels
Run service → Run response: builds response

More Go diagrams: kubeai-project/kubeai · cloudposse/atmos · enterpilot/gomodel · picosh/pico · favadi/protoc-go-inject-tag

Drawn by GitDiagram on September 28, 2026 from the repository's file tree, README and source files. Read as Markdown ·