Configuration

The complete environment-variable reference for the Code Interpreter, grouped by microservice — every CODEAPI_*, SANDBOX_*, REDIS_*, and MINIO_* key each service reads, with defaults and whether it is required.

Every Code Interpreter service is configured entirely through environment variables. In the Compose stack these are set in config/.env under the same names the containers read (documented below); config/codeapi.compose.yml passes each one straight through.

Secrets are auto-provisioned

Every value marked (auto-provisioned) below is generated for you by intelliask secrets gen and the Garage bootstrap — you should never set these by hand. They include the JWT keypair, the execution-manifest keypair, the internal service token, the egress-grant secret, and the S3 (Garage) keys.

Shared across all services

These are read by every (or nearly every) service and must match across them.

Name	Purpose	Default	Required
`LOCAL_MODE`	Local dev mode; disables auth verification when `true`	`false`	No
`CODEAPI_HARDENED_SANDBOX_MODE`	Master security switch — env scrubbing, manifest signing, network isolation	`true`	No
`CODEAPI_AUTH_PROVIDER`	Auth mode: `intelliask-jwt` or `none`	`intelliask-jwt`	No
`CODEAPI_INTERNAL_SERVICE_TOKEN`	Shared HMAC secret for service-to-service auth	(auto-provisioned)	Yes
`REDIS_HOST`	Redis hostname	`redis`	No
`REDIS_PORT`	Redis port	`6379`	No
`REDIS_PASSWORD`	Redis password (blank = no auth)	(empty)	No

Keep hardened mode consistent

CODEAPI_HARDENED_SANDBOX_MODE must be set to the same value on the api, service-worker, egress-gateway, and sandbox-runner. A mismatch (e.g. the worker signing manifests the runner doesn't require, or vice-versa) will reject jobs.

api

Container: codeapi-api · Port: 3112 · Public entry point; verifies the JWT and enqueues jobs.

Name	Purpose	Default	Required
`SERVICE_PORT`	Bind port	`3112`	No
`FILE_SERVER_URL`	Internal URL of the file-server	`http://codeapi-file-server:3000`	No
`TOOL_CALL_SERVER_URL`	Internal URL of the tool-call-server	`http://codeapi-tool-call-server:3033`	No
`EGRESS_GATEWAY_URL`	Internal URL of the egress-gateway	`http://codeapi-egress-gateway:3190`	No
`SANDBOX_ENDPOINT`	Sandbox-runner API v2 URL	`http://codeapi-sandbox-runner:2000/api/v2`	No
`CODEAPI_JWT_ISSUER`	Expected JWT `iss` claim	`intelliask`	No
`CODEAPI_JWT_AUDIENCE`	Expected JWT `aud` claim	`codeapi`	No
`CODEAPI_JWT_ALLOWED_ALGS`	Accepted JWT algorithms (comma-separated)	`EdDSA,RS256`	No
`CODEAPI_JWT_KID`	Key-ID hint for JWT key selection	`intelliask-codeapi`	No
`CODEAPI_JWT_PUBLIC_KEY`	PEM Ed25519 public key used to verify incoming JWTs	(auto-provisioned)	Yes
`CODEAPI_JWT_SINGLE_TENANT_ID`	Tenant ID all requests run under (single-tenant mode)	`legacy`	No
`CODEAPI_TENANT_ISOLATION_STRICT`	Require an explicit tenant header	`false`	No

service-worker

Container: codeapi-service-worker · Health port: 3113 · Dequeues jobs, signs the execution manifest, drives the sandbox.

Name	Purpose	Default	Required
`WORKER_HEALTH_PORT`	Health-check port (used by `depends_on`)	`3113`	No
`PYTHON_CONCURRENCY`	Max concurrent Python jobs	`5`	No
`OTHER_CONCURRENCY`	Max concurrent non-Python jobs (Node, Bash, …)	`8`	No
`SANDBOX_ENDPOINT`	Sandbox-runner API v2 URL	`http://codeapi-sandbox-runner:2000/api/v2`	No
`EGRESS_GATEWAY_URL`	Internal URL of the egress-gateway	`http://codeapi-egress-gateway:3190`	No
`CODEAPI_EXECUTION_MANIFEST_PRIVATE_KEY`	Ed25519 private key used to sign execution manifests	(auto-provisioned)	Yes
`CODEAPI_JWT_SINGLE_TENANT_ID`	Tenant ID (single-tenant mode)	`legacy`	No
`CODEAPI_TENANT_ISOLATION_STRICT`	Require an explicit tenant header	`false`	No

file-server

Container: codeapi-file-server · Port: 3000 · S3-compatible object I/O for job files, backed by Garage.

Name	Purpose	Default	Required
`FILE_SERVER_PORT`	Bind port	`3000`	No
`MINIO_ENDPOINT`	S3 endpoint hostname (Garage or external)	`garage`	No
`MINIO_PORT`	S3 endpoint port	`3900`	No
`MINIO_USE_SSL`	Use HTTPS to S3	`false`	No
`MINIO_BUCKET`	S3 bucket name	`intelliask-codeinterpreter`	Yes
`MINIO_ACCESS_KEY`	S3 access key ID	(auto-provisioned)	Yes
`MINIO_SECRET_KEY`	S3 secret access key	(auto-provisioned)	Yes

MINIO_* are the S3 credentials

Despite the name, MINIO_* are just the generic S3 client settings. By default they point at the bundled Garage store; set them to an external S3 endpoint (AWS S3, MinIO, etc.) to use your own object storage. They must match the keys created by the Garage bootstrap. See Components → Garage.

tool-call-server

Container: codeapi-tool-call-server · Port: 3033 · Brokers tool/function calls and manages sessions.

Name	Purpose	Default	Required
`TOOL_CALL_SERVER_PORT`	Bind port	`3033`	No
`TOOL_CALL_REQUEST_TIMEOUT`	Max time per tool call (ms)	`300000` (5 min)	No
`TOOL_CALL_SESSION_EXPIRY`	Idle session lifetime (seconds)	`600`	No

egress-gateway

Container: codeapi-egress-gateway · Port: 3190 · Forward proxy for all sandbox outbound traffic; signs and verifies egress grants.

Name	Purpose	Default	Required
`SERVICE_NAME`	Service identifier (logging)	`egress-gateway`	No
`EGRESS_GATEWAY_PORT`	Bind port	`3190`	No
`EGRESS_GATEWAY_MAX_TOOL_CALL_BYTES`	Max bytes per proxied tool-call request	`1048576` (1 MiB)	No
`CODEAPI_EGRESS_LEDGER_REQUIRED`	Require a signed egress grant per request	`true`	No
`EGRESS_GATEWAY_FILE_SERVER_URL`	File-server URL (internal)	`http://codeapi-file-server:3000`	No
`EGRESS_GATEWAY_TOOL_CALL_SERVER_URL`	Tool-call-server URL (internal)	`http://codeapi-tool-call-server:3033`	No
`CODEAPI_EGRESS_GRANT_SECRET`	HMAC secret used to sign egress grants	(auto-provisioned)	Yes

sandbox-runner

Container: codeapi-sandbox-runner · Port: 2000 · Privileged. Executes untrusted code in NsJail. This service has the largest surface because it governs isolation, resource limits, and the sandbox filesystem.

Isolation & mounts

Name	Purpose	Default	Required
`KVM_ENABLED`	Use libkrun microVM isolation (`true`) vs direct NsJail (`false`)	`false`	No
`SANDBOX_PACKAGES_DIRECTORY`	Read-only mount point for language runtimes	`/pkgs`	No
`NSJAIL_PATH`	Path to the NsJail binary	`/usr/sbin/nsjail`	No
`NSJAIL_CONFIG`	Path to the NsJail config (mounts, namespaces, seccomp)	`/sandbox_api/config/sandbox.cfg`	No
`SANDBOX_CHECK_CGROUP_LIMITS`	Verify cgroup v2 support at startup (fails fast if missing)	`true`	No
`SANDBOX_EXTRA_READONLY_DIRS`	Colon-separated paths bind-mounted read-only into every sandbox	`/app/client/public/images`	No
`LAUNCHER_VCPUS`	microVM vCPU count (only when `KVM_ENABLED=true`)	`2`	No
`LAUNCHER_RAM_MIB`	microVM RAM in MiB (only when `KVM_ENABLED=true`)	`2048`	No

SANDBOX_EXTRA_READONLY_DIRS is shared across tenants

Anything listed here is visible to every job, of every tenant. Only expose non-sensitive shared assets (e.g. public image directories) — never secrets or per-user data.

Resource & output limits

Name	Purpose	Default	Required
`SANDBOX_RUN_TIMEOUT`	Max wall-clock time per job (ms)	`300000` (5 min)	No
`SANDBOX_RUN_CPU_TIME`	Max CPU time per job (ms)	`300000` (5 min)	No
`SANDBOX_COMPILE_TIMEOUT`	Compilation-phase timeout for compiled langs (ms)	`30000` (30 s)	No
`SANDBOX_RUN_MEMORY_LIMIT`	Memory cgroup limit (bytes; `-1` = unlimited)	`1073741824` (1 GiB)	No
`SANDBOX_RLIMIT_AS`	Virtual address-space limit (MB)	`4096`	No
`SANDBOX_RLIMIT_AS_BROWSER`	Address-space limit for browser jobs; `inf`/`max`/number	`inf`	No
`SANDBOX_RLIMIT_FSIZE`	Max file size a job may write (MB)	`100`	No
`SANDBOX_EXECUTE_BODY_LIMIT`	Max request body (code payload) size	`50mb`	No
`SANDBOX_OUTPUT_MAX_SIZE`	Max stdout/stderr captured per job (bytes)	`65536` (64 KiB)	No
`SANDBOX_MAX_CONCURRENT_JOBS`	Max parallel jobs on this runner	`8`	No
`SANDBOX_UPLOAD_CONCURRENCY`	Concurrent S3 uploads per job	`8`	No
`SANDBOX_WORKSPACE_REAPER_MAX_AGE_SECONDS`	Age at which idle workspaces are cleaned up (s)	`3600`	No
`SANDBOX_LOG_LEVEL`	Log verbosity (`DEBUG`/`INFO`/`WARN`/`ERROR`)	`INFO`	No

Browser jobs need more memory

Chromium (Playwright) needs roughly 1 GiB, which is why SANDBOX_RUN_MEMORY_LIMIT defaults to 1073741824. Browser jobs also use SANDBOX_RLIMIT_AS_BROWSER=inf because Chromium's V8 reserves a very large virtual address space — a numeric cap would crash it with SIGTRAP.

Network & security

Name	Purpose	Default	Required
`SANDBOX_DISABLE_NETWORKING`	Isolate the sandbox from the network (only the egress-gateway is reachable)	`true`	No
`SANDBOX_ALLOWED_LOCAL_NETWORK_PORT`	The single local port the sandbox may reach (the egress-gateway)	`3190`	No
`SANDBOX_REQUIRE_EGRESS_MANIFEST`	Reject unsigned job requests	`true`	No
`EGRESS_GATEWAY_URL`	Egress-gateway URL for allowed outbound requests	`http://codeapi-egress-gateway:3190`	No
`SANDBOX_FORWARD_TARGET`	Fallback egress target if the primary gateway fails	`codeapi-egress-gateway:3190`	No
`SANDBOX_EXECUTION_MANIFEST_PUBLIC_KEY`	Ed25519 public key used to verify execution manifests	(auto-provisioned)	Yes

Browser support

Name	Purpose	Default	Required
`PLAYWRIGHT_BROWSERS_PATH`	Path to the Chromium build for browser jobs	`${SANDBOX_PACKAGES_DIRECTORY}/ms-playwright` (auto-derived)	No

Redis

Container: redis · Job queue, cache, tool-call sessions, and the egress-grant ledger. Every codeapi service reads these REDIS_* keys.

Name	Purpose	Default	Required
`REDIS_HOST`	Redis hostname	`redis`	No
`REDIS_PORT`	Redis port	`6379`	No
`REDIS_PASSWORD`	Redis auth password	(empty)	No

Garage (S3)

Container: garage · The bundled S3 store backing the file-server. See Components → Garage for the full lifecycle.

Name	Purpose	Default	Required
`GARAGE_RPC_SECRET`	Internal cluster secret (node-to-node auth)	(auto-provisioned)	Yes
`GARAGE_ADMIN_TOKEN`	Admin API token used by the bootstrap to create the bucket/keys	(auto-provisioned)	Yes
`MINIO_ACCESS_KEY`	S3 access key (shared with the file-server)	(auto-provisioned)	Yes
`MINIO_SECRET_KEY`	S3 secret key (shared with the file-server)	(auto-provisioned)	Yes
`MINIO_BUCKET`	S3 bucket for job files	`intelliask-codeinterpreter`	Yes

Applying changes

The Code Interpreter services read env at startup, so after editing any CODEAPI_* value in config/.env, recreate the affected services:

intelliask up codeapi-api codeapi-service-worker codeapi-sandbox-runner
# or simply bring the whole codeapi profile back up:
intelliask up

Run intelliask env doctor first to confirm every variable is wired between config/.env and the compose files.