# langgenius/dify-sandbox architecture

> Architecture diagram of the GitHub repository langgenius/dify-sandbox, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/langgenius/dify-sandbox
- Repository: https://github.com/langgenius/dify-sandbox

## Overview

Dify-Sandbox is a multi-tenant service for executing submitted code in a restricted environment. Its main workflow accepts an authenticated run request, dispatches it to a language-specific execution path, captures process output and returns an execution result; the tree also shows dependency management and syscall sandboxing as separate capabilities. The sampled router and output-capture code support those boundaries, but the run controller and language-specific service/runner implementations were not sampled, so their internal call wiring is left unspecified.

Main entry points: [`internal/server/server.go`](https://github.com/langgenius/dify-sandbox/blob/main/internal/server/server.go) (HTTP server), [`internal/controller/router.go`](https://github.com/langgenius/dify-sandbox/blob/main/internal/controller/router.go) (Route setup), [`internal/core/runner/python`](https://github.com/langgenius/dify-sandbox/tree/main/internal/core/runner/python) (Python runner), [`internal/service/run_code.go`](https://github.com/langgenius/dify-sandbox/blob/main/internal/service/run_code.go) (Run service)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_api["API and access"]
  node_server["HTTP server<br/>[server.go]"]
  node_routes["Route setup<br/>[router.go]"]
  node_middleware["Auth and limits"]
  node_runcontroller["Run controller<br/>[run.go]"]
  node_dependency_routes["Dependency endpoints<br/>[base.go]"]
end

subgraph group_execution["Execution"]
  node_runservice["Run service<br/>[run_code.go]"]
  node_node_service["Node.js service<br/>[nodejs.go]"]
  node_python_service["Python service<br/>[python.go]"]
  node_node_runner["Node.js runner"]
  node_python_runner["Python runner"]
  node_output["Output capture<br/>[output_capture.go]"]
  node_response["Run response<br/>[response.go]"]
end

subgraph group_security["Sandbox security"]
  node_node_seccomp["Node.js seccomp<br/>[add_seccomp.go]"]
  node_python_seccomp["Python seccomp<br/>[add_seccomp.go]"]
  node_seccomp["Syscall policy<br/>[seccomp.go]"]
end

subgraph group_dependencies["Dependencies and config"]
  node_config["Runtime config<br/>[config.go]"]
  node_discovery["Python library discovery"]
  node_python_deps["Python dependencies"]
end

node_client(("API client"))

node_client -->|"sends requests"| node_server
node_server -->|"sets up routes"| node_routes
node_server -->|"loads config"| node_config
node_routes -->|"attaches middleware"| node_middleware
node_routes -->|"dispatches run"| node_runcontroller
node_routes -->|"registers endpoints"| node_dependency_routes
node_server -->|"prepares dependencies"| node_python_deps
node_node_runner -.-> node_node_seccomp
node_python_runner -.-> node_python_seccomp
node_node_seccomp --> node_seccomp
node_python_seccomp --> node_seccomp
node_python_runner -.-> node_discovery
node_output -->|"provides output channels"| node_runservice
node_runservice -->|"builds response"| node_response

click node_server "https://github.com/langgenius/dify-sandbox/blob/main/internal/server/server.go"
click node_routes "https://github.com/langgenius/dify-sandbox/blob/main/internal/controller/router.go"
click node_middleware "https://github.com/langgenius/dify-sandbox/tree/main/internal/middleware"
click node_runcontroller "https://github.com/langgenius/dify-sandbox/blob/main/internal/controller/run.go"
click node_runservice "https://github.com/langgenius/dify-sandbox/blob/main/internal/service/run_code.go"
click node_node_service "https://github.com/langgenius/dify-sandbox/blob/main/internal/service/nodejs.go"
click node_python_service "https://github.com/langgenius/dify-sandbox/blob/main/internal/service/python.go"
click node_node_runner "https://github.com/langgenius/dify-sandbox/tree/main/internal/core/runner/nodejs"
click node_python_runner "https://github.com/langgenius/dify-sandbox/tree/main/internal/core/runner/python"
click node_output "https://github.com/langgenius/dify-sandbox/blob/main/internal/core/runner/output_capture.go"
click node_response "https://github.com/langgenius/dify-sandbox/blob/main/internal/types/response.go"
click node_node_seccomp "https://github.com/langgenius/dify-sandbox/blob/main/internal/core/lib/nodejs/add_seccomp.go"
click node_python_seccomp "https://github.com/langgenius/dify-sandbox/blob/main/internal/core/lib/python/add_seccomp.go"
click node_seccomp "https://github.com/langgenius/dify-sandbox/blob/main/internal/core/lib/seccomp.go"
click node_config "https://github.com/langgenius/dify-sandbox/blob/main/internal/static/config.go"
click node_discovery "https://github.com/langgenius/dify-sandbox/blob/main/internal/static/python_lib_discovery.go"
click node_python_deps "https://github.com/langgenius/dify-sandbox/tree/main/internal/core/runner/python/dependencies"
click node_dependency_routes "https://github.com/langgenius/dify-sandbox/blob/main/internal/controller/base.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_server,node_routes,node_middleware,node_runcontroller,node_dependency_routes,node_client toneBlue
class node_runservice,node_node_service,node_python_service,node_node_runner,node_python_runner,node_output,node_response toneAmber
class node_node_seccomp,node_python_seccomp,node_seccomp toneMint
class node_config,node_discovery,node_python_deps toneRose
```

## Components

### API and access

- [HTTP server](https://github.com/langgenius/dify-sandbox/blob/main/internal/server/server.go): `internal/server/server.go`
- [Route setup](https://github.com/langgenius/dify-sandbox/blob/main/internal/controller/router.go): `internal/controller/router.go`
- [Auth and limits](https://github.com/langgenius/dify-sandbox/tree/main/internal/middleware): `internal/middleware`
- [Run controller](https://github.com/langgenius/dify-sandbox/blob/main/internal/controller/run.go): `internal/controller/run.go`
- [Dependency endpoints](https://github.com/langgenius/dify-sandbox/blob/main/internal/controller/base.go): `internal/controller/base.go`

### Execution

- [Run service](https://github.com/langgenius/dify-sandbox/blob/main/internal/service/run_code.go): `internal/service/run_code.go`
- [Node.js service](https://github.com/langgenius/dify-sandbox/blob/main/internal/service/nodejs.go): `internal/service/nodejs.go`
- [Python service](https://github.com/langgenius/dify-sandbox/blob/main/internal/service/python.go): `internal/service/python.go`
- [Node.js runner](https://github.com/langgenius/dify-sandbox/tree/main/internal/core/runner/nodejs): `internal/core/runner/nodejs`
- [Python runner](https://github.com/langgenius/dify-sandbox/tree/main/internal/core/runner/python): `internal/core/runner/python`
- [Output capture](https://github.com/langgenius/dify-sandbox/blob/main/internal/core/runner/output_capture.go): `internal/core/runner/output_capture.go`
- [Run response](https://github.com/langgenius/dify-sandbox/blob/main/internal/types/response.go): `internal/types/response.go`

### Sandbox security

- [Node.js seccomp](https://github.com/langgenius/dify-sandbox/blob/main/internal/core/lib/nodejs/add_seccomp.go): `internal/core/lib/nodejs/add_seccomp.go`
- [Python seccomp](https://github.com/langgenius/dify-sandbox/blob/main/internal/core/lib/python/add_seccomp.go): `internal/core/lib/python/add_seccomp.go`
- [Syscall policy](https://github.com/langgenius/dify-sandbox/blob/main/internal/core/lib/seccomp.go): `internal/core/lib/seccomp.go`

### Dependencies and config

- [Runtime config](https://github.com/langgenius/dify-sandbox/blob/main/internal/static/config.go): `internal/static/config.go`
- [Python library discovery](https://github.com/langgenius/dify-sandbox/blob/main/internal/static/python_lib_discovery.go): `internal/static/python_lib_discovery.go`
- [Python dependencies](https://github.com/langgenius/dify-sandbox/tree/main/internal/core/runner/python/dependencies): `internal/core/runner/python/dependencies`

### Other components

- **API client**

## Connections

- API client → HTTP server: sends requests
- HTTP server → Route setup: sets up routes
- HTTP server → Runtime config: loads config
- Route setup → Auth and limits: attaches middleware
- Route setup → Run controller: dispatches run
- Route setup → Dependency endpoints: registers endpoints
- HTTP server → Python dependencies: prepares dependencies
- Node.js runner → Node.js seccomp
- Python runner → Python seccomp
- Node.js seccomp → Syscall policy
- Python seccomp → Syscall policy
- Python runner → Python library discovery
- Output capture → Run service: provides output channels
- Run service → Run response: builds response