Declaw icon

Declaw

Run code securely in Firecracker microVM sandboxes — create sandboxes, execute commands, manage files

Actions24

Code Interpreter → Execute

AI-generated

Summary

Runs Python or JavaScript code in a fresh, short-lived Declaw Firecracker microVM sandbox. It creates the sandbox, uploads the code, runs it, collects the results, and deletes the sandbox, all in one step per input item.

Inputs

  • Language — Python (default) or JavaScript. Python uses the 'python' template and runs python3 /home/user/main.py. JavaScript uses the 'node' template and runs node /home/user/main.js.
  • Code (required) — Source code written to the main file in the sandbox and executed.
  • Additional Files (JSON) — JSON array of {path, data} objects, where both are strings. The files are uploaded before execution. Invalid JSON or entries throw an error.
  • Environment Variables — Key/value pairs set as environment variables when the sandbox is created.
  • Network Egress Allowlist — Comma-separated domains the sandbox may reach (sent as network allow_out).
  • Output Files — Comma-separated sandbox file paths to read after execution and include in the result.
  • Enable PII Protection — Turns on PII detection with the types email, phone_number, ssn and credit_card.
  • PII Action — Alert, Block or Redact (default Redact). Only shown when PII protection is enabled. Note that the source passes the value straight through as the policy action.
  • Enable Injection Defense — Enables injection defense at medium sensitivity, threshold 0.8, with action block.
  • Security Policy (JSON) — Raw JSON security policy object. When set, it replaces the PII and injection toggles.
  • Timeout (Seconds) — Command execution timeout, default 30. The sandbox itself is created with an auto-kill timeout of this value plus 120 seconds.

Output shape

One JSON item per input item with stdout, stderr, exit_code and language. If Output Files is set, it also has output_files, a map of path to file content.

stdout and stderr default to an empty string, and exit_code defaults to -1 if the API omits it. A failed read of an output file gives the string 'ERROR: ' for that path instead of failing the node. File contents are returned as text, or as JSON-stringified data if the API returns an object. The sandbox is always deleted afterward, even on failure, and cleanup errors are ignored, so no state persists between runs. A non-zero exit code does not throw an error. Errors in setup or the API throw, unless Continue On Fail is on, in which case the item contains {error}. Requires Declaw API credentials.

Examples

Example 1: Run a quick Python calculation

Language: Python; Code: print(sum(range(10))); read stdout from the output.

Example 2: Process a CSV and fetch the result file

Additional Files: [{"path":"/home/user/data.csv","data":"a,b\n1,2"}]; Code reads the CSV and writes /home/user/result.json; Output Files: /home/user/result.json.

Example 3: Call an external API with PII redaction

Language: JavaScript; Network Egress Allowlist: api.example.com; Environment Variables: API_KEY; Enable PII Protection on with Action Redact.

Links

Discussion