Langflow code sandbox: run flow code in a CreateOS microVM

Langflow code sandbox: run flow code in a CreateOS microVM

To run code from a Langflow flow in a sandbox, install langflow-sandbox-createos into Langflow's environment, export your CreateOS API key and LANGFLOW_SANDBOX_CREATEOS_ACCEPT_EGRESS_EXCEPTIONS=true, start langflow run, and drag the CreateOS Sandbox component onto the canvas. The node's code then runs on a disposable Linux microVM on CreateOS, not in the Langflow process. With Guest Reuse off, the default, the VM is deleted after every run.

This setup is for Langflow users who want flow code kept out of the Langflow server, including on hosts with no hypervisor. CreateOS Sandbox runs each job in a Firecracker microVM with its own guest kernel, root filesystem and network identity.

The langflow-sandbox-createos package is maintained by CreateOS and is not a Langflow product.

Key takeaways

• One pip install langflow-sandbox-createos ships three surfaces: a CreateOS Sandbox component, a sandbox backend for the Python Interpreter node, and a whole-flow executor.
• Each run gets a microVM with its own guest kernel, so flow code is VM-isolated from the Langflow host.
• With Allow Network off, runs are refused until you set LANGFLOW_SANDBOX_CREATEOS_ACCEPT_EGRESS_EXCEPTIONS=true.
• The plugin refuses domain allowlists. In the component and the backend, network access is either off or completely open.

Why run Langflow code in a remote sandbox?

By default, Langflow runs the Python Interpreter node's code inside the Langflow server process, per Langflow's Python Interpreter docs. The built-in option, exec-sandbox, boots a QEMU microVM on the Langflow host, which needs a hypervisor device on that host.

Managed platforms, most containers and Apple Silicon CI do not have one. The CreateOS package moves the VM off the host (comparison in the docs):

For background, read what an AI agent sandbox is.

How do I set up a Langflow code sandbox with CreateOS?

Four steps take you from install to a first run of the CreateOS Sandbox component. You need Langflow on Python 3.10 or newer and a CreateOS account.

Step 1: How do I install the CreateOS package for Langflow?

Run pip install langflow-sandbox-createos in the same environment Langflow runs in. The package is on PyPI.

Step 2: How do I give Langflow a CreateOS API key?

Export CREATEOS_SANDBOX_API_KEY='your-key-here' before you start Langflow. Every surface uses this key. If it is unset, the plugin falls back to CREATEOS_API_KEY. The Install section of the docs shows where to create a key.

Step 3: Why do I need to set the egress exceptions variable?

Export LANGFLOW_SANDBOX_CREATEOS_ACCEPT_EGRESS_EXCEPTIONS=true, or runs with the network off are refused. Allow Network is off by default on the component. Even with egress off, a CreateOS guest can still reach the 169.254.0.0/16 link-local range, which carries the VM metadata service.

The plugin will not treat that as "off" without your consent. Read Network rules before you set it.

Step 4: How do I add the CreateOS Sandbox node to a flow?

Start Langflow with langflow run, search the component list for CreateOS Sandbox, and drag it onto the canvas. Its Python Code input defaults to print('hello from a microVM'), so you can run it as it is. The Results output returns result (the trimmed stdout), stderr, exit_code and the sandbox_id of the guest it ran on.

Set Command to run a shell command instead. Turn on Return Files to get back what the guest wrote to /workspace/artifacts (component reference).

How do I sandbox the Python Interpreter node without changing the flow?

Use the sandbox backend, which needs four exports. Set LANGFLOW_SANDBOX_BACKEND_PLUGINS=createos, LANGFLOW_SANDBOX_BACKEND=createos, your API key, and LANGFLOW_SANDBOX_CREATEOS_ACCEPT_EGRESS_EXCEPTIONS=true. LANGFLOW_SANDBOX_ALLOW_NETWORK is false by default, so the backend needs that last variable too.

The first variable is Langflow's trust gate. Nothing on the canvas changes. A backend that cannot do its job refuses to run and never falls back to running code in the Langflow process (backend docs).

The backend cannot reuse a guest or return files. Both live in the component.

Can code in a Langflow sandbox reach the internet?

In the component and the backend, only when you turn the network on, and then outbound access is completely open. A CreateOS sandbox with no egress rules can reach any external host. Once any rule is set, it becomes deny-by-default: only listed destinations pass, and everything else is dropped in-kernel on the host, outside the VM (Limits and defaults).

With Allow Network off, the plugin sets one unroutable rule, so the guest reaches nothing except the link-local range from Step 3.

• Domain allowlists are refused. The plugin refuses any run that asks for one, and only address and CIDR rules reach the policy.
• On means unrestricted. There is no package-registry-only setting.
• The executor defaults to open. It has no refusal and no warning.

The Egress API lists every rule format. For the threat model, read how CreateOS isolates networked sandboxes.

What are the limits of the Langflow integration?

The main limits are network control, leftover guests when reuse is on, and the executor's reach.

• Guest Reuse leaves VMs behind. With reuse set to flow, the guest outlives the flow run. Delete leftover lf-c-* sandboxes yourself (reuse notes).
• Shared guests. With reuse on, two workers running the same flow share one filesystem.
• Returned files. At most 5 MiB and 256 files come back per run.
• The executor skips the canvas. LANGFLOW_EXECUTOR_KIND=createos covers /api/v1/run, the lfx command line and Loop subgraphs. The playground still runs in the server process.
• No retries. A control-plane error shows up as a failed run.
• Account caps. Creating a sandbox over your account's concurrent cap fails rather than queueing, and paused sandboxes count toward it (caps).

Firecracker sandboxes for AI agents covers the VM model underneath.

When do I not need this?

If your Langflow host has a hypervisor device and you need a domain allowlist inside Langflow, use Langflow's built-in exec-sandbox. It filters DNS inside the guest.

Common questions

How do I run Langflow code in a sandbox without a local hypervisor?

Install langflow-sandbox-createos, export your CreateOS API key and LANGFLOW_SANDBOX_CREATEOS_ACCEPT_EGRESS_EXCEPTIONS=true, then drag the CreateOS Sandbox component onto the canvas. The VM runs on CreateOS, so the Langflow host needs no hypervisor device.

Why does the CreateOS Sandbox component refuse to run with Allow Network off?

A CreateOS guest can always reach the 169.254.0.0/16 link-local range, which carries the VM metadata service. The plugin refuses to treat that as "off" until you set LANGFLOW_SANDBOX_CREATEOS_ACCEPT_EGRESS_EXCEPTIONS=true.

Can I limit a Langflow sandbox on CreateOS to specific domains?

Not through this plugin. It refuses any run that asks for a domain allowlist, and only address and CIDR rules reach the policy, so in the component and the backend network access is either off or completely open. CreateOS itself enforces hostname rules set through its Egress API, but the plugin does not pass them. If you need a domain allowlist inside Langflow, use Langflow's built-in exec-sandbox.

What happens to the microVM after a Langflow run?

With Guest Reuse off, the default, the VM is deleted after every run, even when the run failed. With reuse set to flow, the guest stays for the next run, so delete leftover sandboxes yourself.

Does the whole-flow executor cover runs from the Langflow canvas?

No. The executor covers the /api/v1/run endpoint, the lfx command line and Loop subgraphs. Langflow's UI build endpoint never enters that path, so the playground still runs in the server process.

Is langflow-sandbox-createos a Langflow product?

No. The package is maintained by CreateOS and is not a Langflow product. It installs from PyPI and plugs into Langflow as a component, a sandbox backend and a flow executor.

Next step

Open the Langflow integration docs, then create your API key in the CreateOS app and run your first node.

About CreateOS

CreateOS runs AI agents and the code they write. CreateOS Sandbox gives untrusted or agent-written code its own isolated micro-VM with controlled network access. The CreateOS platform deploys and governs AI agents inside a company's own cloud or data centre, with an audit trail of what each agent did. Start at createos.sh.