{"record":{"id":"8fe9ef1af7216c57","repo":"iflytek/astron-agent","slug":"code-execution-error-the-local-executor-is-disabled-for","errorCode":"CODE_EXECUTION_ERROR","errorMessage":"The local code executor is disabled for security. Configure an isolated code executor before running code nodes.","messagePattern":"The local code executor is disabled for security\\. Configure an isolated code executor before running code nodes\\.","errorType":"error_code","errorClass":"CustomException","httpStatus":null,"severity":"error","filePath":"core/workflow/engine/nodes/code/executor/local/local_executor.py","lineNumber":20,"sourceCode":"\nfrom workflow.engine.nodes.code.executor.base_executor import BaseExecutor\nfrom workflow.exception.e import CustomException\nfrom workflow.exception.errors.err_code import CodeEnum\nfrom workflow.extensions.otlp.trace.span import Span\n\n\nclass LocalExecutor(BaseExecutor):\n    \"\"\"Compatibility shim for the removed in-process code executor.\n\n    User-provided code must never execute in the workflow service process. A\n    child process and a timeout do not isolate the filesystem, credentials,\n    network, or operating-system user from untrusted code.\n    \"\"\"\n\n    async def execute(\n        self, language: str, code: str, timeout: int, span: Span, **kwargs: Any\n    ) -> str:\n        raise CustomException(\n            err_code=CodeEnum.CODE_EXECUTION_ERROR,\n            err_msg=(\n                \"The local code executor is disabled for security. \"\n                \"Configure an isolated code executor before running code nodes.\"\n            ),\n        )\n","sourceCodeStart":2,"sourceCodeEnd":27,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/core/workflow/engine/nodes/code/executor/local/local_executor.py#L2-L27","documentation":"The LocalCodeExecutor is a deliberately gutted implementation: its execute() method unconditionally raises CODE_EXECUTION_ERROR with a fixed message stating the local executor is disabled for security, because running untrusted code on the host (no isolation of filesystem, network, or OS user) is unsafe. Any workflow code node routed to the local executor fails immediately.","triggerScenarios":"Selecting/configuring the code node to use the local executor — i.e. no isolated (remote/sandboxed) code executor is configured — and then executing any code node.","commonSituations":"Self-hosted deployments where nobody configured an isolated code-executor backend, so the default falls back to local; fresh installs following outdated docs; environments where the sandbox service was never deployed.","solutions":["Deploy and configure an isolated code executor (e.g. the iFly sandbox service) and point the code node's executor config at it.","Set the executor selection config/env so code nodes no longer resolve to LocalCodeExecutor.","If local execution must be enabled, do so only inside a hardened isolated container — never on the host directly.","Update deployment docs/checks to fail fast with a config validation error before running workflows."],"exampleFix":"// before: executor defaults to local\nexecutor = get_executor(\"local\")\n// after: require an isolated executor in config\nexecutor_type = config.get(\"code_executor_type\")\nif executor_type in (None, \"local\"):\n    raise ValueError(\"Configure an isolated code executor (code_executor_type) before running code nodes\")\nexecutor = get_executor(executor_type)","handlingStrategy":"validation","validationCode":"executor_type = config.get(\"code_executor_type\")\nif not executor_type or executor_type == \"local\":\n    raise ValueError(\"code_executor_type must point to an isolated executor (not 'local')\")","typeGuard":"def is_isolated_executor(executor) -> bool:\n    return not isinstance(executor, LocalCodeExecutor)","tryCatchPattern":"try:\n    output = await code_node.async_execute(...)\nexcept CustomException as e:\n    if \"disabled for security\" in str(e.err_msg):\n        raise RuntimeError(\"Deploy and configure an isolated code executor before using code nodes\") from e","preventionTips":["Validate executor configuration at service startup, not at node execution time","Document and enforce the isolated code-executor deployment in install guides","Fail workflow publish early if the selected executor is the disabled local one"],"tags":["security","configuration","sandbox","disabled-feature"],"backgroundTag":"feature-not-enabled","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}