Sandboxed code execution for LibreChat
Run untrusted code without trusting it
Code Interpreter executes model-generated programs inside a microVM with its own kernel, hands them no network and no credentials, and returns their output and files. Self-hostable with Docker Compose or Helm.
# bring up the full stack
CODEAPI_LANGUAGES=python docker compose up --build
# run something
curl -sX POST localhost:3112/v1/exec \
-H 'Content-Type: application/json' \
-d '{"lang":"py","code":"print(sum(range(10)))"}'Real isolation
A libkrun microVM with its own guest kernel, NsJail inside it, a seccomp deny-list, cgroups, and an empty network namespace.
Files in and out
Callers upload inputs, code reads and writes them, artifacts come back — through S3-compatible storage, namespaced per user.
Tool calling
Sandboxed programs pause, call back into your tools, and resume with the results. Your tools never run in the sandbox.
Scales horizontally
API, workers, file server, and gateway are separate services over Redis and object storage, each scaling on its own.