Code Interpreter
The Code Interpreter (codeapi) is IntelliAsk's sandboxed code-execution service — six hardened microservices that run untrusted user code in isolated NsJail sandboxes. This is the complete reference for its architecture, environment surface, and security model.
The Code Interpreter (internally codeapi) is the service behind IntelliAsk's Run Code feature. It executes untrusted, model-generated code in strongly isolated sandboxes and returns the results — stdout, files, images, and errors — back to the chat.
It is tailored for IntelliAsk — no-KVM sandboxing for the deployment hosts, browser and packet-capture capabilities, and IntelliAsk JWT authentication.
Looking to just run it?
To wire the Code Interpreter into the Compose stack (image tags, CPU/memory
limits, and the stack-level CODEAPI_* keys), see
Deploy → Components → Code Interpreter.
For the end-user feature, see Features → Code Interpreter.
What's in this section
Architecture
The six microservices + Redis + Garage, how a job flows through them, the ports each exposes, and the language-runtime package tree.
Configuration
The complete environment-variable reference, grouped by service — every
CODEAPI_*, SANDBOX_*, REDIS_*, and MINIO_* key it reads.
Runtime Packages
The Package Builder Kit for building your own Python, Node.js, Bun, and Bash bundle.
Security model
Hardened sandbox mode, JWT verification, signed execution manifests, network egress control, and the secrets the stack auto-provisions.
At a glance
| Services | 6 (api, service-worker, file-server, tool-call-server, egress-gateway, sandbox-runner) + Redis + Garage |
| Public entry point | codeapi-api on port 3112 |
| Isolation | NsJail (direct, no-KVM) sandboxes; optional libkrun microVM |
| Storage | S3-compatible (Garage by default) via the file-server |
| Auth | IntelliAsk-signed Ed25519 JWT (EdDSA) |
Key capabilities
- Multi-language execution — Python, Node.js/TypeScript, Bash, and more, each with a pre-built package tree mounted read-only into the sandbox.
- Seamless file handling — job inputs and generated outputs (files, plots, images) are stored in S3 via the file-server and surfaced back to the chat.
- Programmatic tool calling — sandboxed code can invoke tools through the tool-call-server, brokered over the egress-gateway.
- Defense in depth — untrusted code runs with a scrubbed environment, a signed execution manifest, no direct network, and hard CPU/memory/time limits.
Last updated on