mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-24 15:47:29 +08:00
71fbf5ff00
* version-1.9.0-docs * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
43 lines
2.5 KiB
Plaintext
43 lines
2.5 KiB
Plaintext
---
|
||
title: Block custom components
|
||
slug: /deployment-block-custom-components
|
||
---
|
||
|
||
Custom components and the component code editor allow Langflow users to create and execute Python code in the Langflow runtime.
|
||
While this freedom is a feature of Langflow, in some deployments you might want to block the creation of custom Langflow components to prevent arbitrary code execution.
|
||
|
||
To block custom component creation on a Langflow server, set the following [environment variable](/environment-variables):
|
||
|
||
```bash
|
||
LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false
|
||
```
|
||
|
||
When set to `false`, Langflow blocks creating custom components and changing code in the visual editor.
|
||
|
||
When unset or `true`, Langflow allows custom code.
|
||
Existing Langflow installations will keep the default `true` behavior until you opt in to this restriction.
|
||
|
||
This environment variable is a beta feature, and should not be your only safeguard in production environments.
|
||
|
||
In the event that Langflow could execute untrusted or LLM-generated code, run Langflow in an isolated and containerized execution environment.
|
||
|
||
### Configure a custom component allow-list
|
||
|
||
`LANGFLOW_ALLOW_CUSTOM_COMPONENTS` works together with optional paths that define which component templates the server loads, and which code hashes are trusted.
|
||
|
||
Directories listed in the `LANGFLOW_COMPONENTS_PATH` environment variable are loaded as custom components and merged into the server’s template set.
|
||
When `LANGFLOW_ALLOW_CUSTOM_COMPONENTS` is set to `false`, the components in the `LANGFLOW_COMPONENTS_PATH` directory **remain allowed**.
|
||
|
||
To allow some components while blocking others, include the allowed custom components directory in `LANGFLOW_COMPONENTS_PATH` and set `LANGFLOW_ALLOW_CUSTOM_COMPONENTS` to `false`.
|
||
|
||
`LANGFLOW_COMPONENTS_INDEX_PATH` points to a prebuilt component index JSON file at a local path or `http://` / `https://` URL.
|
||
This environment variable replaces the default index bundled with the `lfx` package.
|
||
It does **not** import Python modules from a directory on disk.
|
||
To allow-list custom components, use the `LANGFLOW_COMPONENTS_PATH` environment variable.
|
||
|
||
If both environment variables are set, Langflow builds one combined set of components from the custom index _and_ from `LANGFLOW_COMPONENTS_PATH`. If the same component category name exists in both, `LANGFLOW_COMPONENTS_PATH` replaces that whole category from the custom index.
|
||
|
||
For more information, see:
|
||
|
||
* [Environment variables](/environment-variables#visual-editor-and-playground-behavior)
|
||
* [Security](/security) |