opensource/dify
2
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 02:28:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: clean up env in example (#39044)

Browse Source 
Co-authored-by: -LAN- <laipz8200@outlook.com>
This commit is contained in:
Yunlu Wen 2026-07-17 00:51:04 +08:00 committed by GitHub
parent 1aea3460af
commit 96e34e7b24
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 22 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
docker/.env.example
View File

@ -270,15 +270,6 @@ DIFY_AGENT_STUB_API_BASE_URL=http://agent_backend:5050/agent-stub
# Replace this development default in production.
# Generate one with: python -c 'import secrets; print(secrets.token_urlsafe(32))'
DIFY_AGENT_SERVER_SECRET_KEY=MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY
# Agent sandbox path isolation (Landlock), applied inside the local_sandbox container.
# Set SHELLCTL_ENABLE_PATH_ISOLATION=false to disable Landlock entirely (default: true).
SHELLCTL_ENABLE_PATH_ISOLATION=true
# The paths below override the built-in defaults when set (even to an empty value).
# Leave them commented out to keep the defaults; setting SHELLCTL_LANDLOCK_RO_PATHS or
# SHELLCTL_LANDLOCK_RW_DEV_PATHS to an empty string removes all default paths and can break exec.
# SHELLCTL_LANDLOCK_RW_PATHS=
# SHELLCTL_LANDLOCK_RO_PATHS=
# SHELLCTL_LANDLOCK_RW_DEV_PATHS=
# Nginx and Docker Compose
NGINX_SERVER_NAME=_

10
docker/docker-compose-template.yaml
View File

@ -526,15 +526,11 @@ services:
local_sandbox:
image: langgenius/dify-agent-local-sandbox:1.16.0-rc1
restart: always
env_file:
- path: ./envs/core-services/local-sandbox.env
required: false
environment:
- SHELLCTL_AUTH_TOKEN=${DIFY_AGENT_SHELLCTL_AUTH_TOKEN:-}
# Landlock path isolation. SHELLCTL_ENABLE_PATH_ISOLATION defaults to true in the runtime.
- SHELLCTL_ENABLE_PATH_ISOLATION=${SHELLCTL_ENABLE_PATH_ISOLATION:-true}
# Passed through only when set (uncommented) in .env; leaving them unset keeps
# the runtime's built-in defaults. Setting them to empty removes all default paths.
- SHELLCTL_LANDLOCK_RW_PATHS
- SHELLCTL_LANDLOCK_RO_PATHS
- SHELLCTL_LANDLOCK_RW_DEV_PATHS
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:5004/healthz"]
interval: 30s

10
docker/docker-compose.yaml
View File

@ -532,15 +532,11 @@ services:
local_sandbox:
image: langgenius/dify-agent-local-sandbox:1.16.0-rc1
restart: always
env_file:
- path: ./envs/core-services/local-sandbox.env
required: false
environment:
- SHELLCTL_AUTH_TOKEN=${DIFY_AGENT_SHELLCTL_AUTH_TOKEN:-}
# Landlock path isolation. SHELLCTL_ENABLE_PATH_ISOLATION defaults to true in the runtime.
- SHELLCTL_ENABLE_PATH_ISOLATION=${SHELLCTL_ENABLE_PATH_ISOLATION:-true}
# Passed through only when set (uncommented) in .env; leaving them unset keeps
# the runtime's built-in defaults. Setting them to empty removes all default paths.
- SHELLCTL_LANDLOCK_RW_PATHS
- SHELLCTL_LANDLOCK_RO_PATHS
- SHELLCTL_LANDLOCK_RW_DEV_PATHS
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:5004/healthz"]
interval: 30s

14
docker/envs/core-services/dify-agent.env.example
View File

@ -26,17 +26,3 @@ DIFY_AGENT_STUB_API_BASE_URL=http://agent_backend:5050/agent-stub
# Replace this development default in production.
# Generate one with: python -c 'import secrets; print(secrets.token_urlsafe(32))'
DIFY_AGENT_SERVER_SECRET_KEY=MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY
# --- Agent sandbox path isolation (Landlock) ---
# Applied by the runtime inside the local_sandbox container.
# Set SHELLCTL_ENABLE_PATH_ISOLATION=false to disable Landlock entirely (default: true).
SHELLCTL_ENABLE_PATH_ISOLATION=true
# The paths below override the built-in defaults when set (even to an empty value).
# Leave them commented out to keep the defaults; setting SHELLCTL_LANDLOCK_RO_PATHS or
# SHELLCTL_LANDLOCK_RW_DEV_PATHS to an empty string removes all default paths and can break exec.
# Comma-separated additional read-write directories (default: none beyond $HOME).
# SHELLCTL_LANDLOCK_RW_PATHS=
# Comma-separated read-only + execute directories (default: /usr,/bin,/sbin,/lib,/lib64,/etc,/proc,/opt/dify-agent-tools,/opt/homebrew,/snap).
# SHELLCTL_LANDLOCK_RO_PATHS=
# Comma-separated read-write device files (default: /dev/null,/dev/zero,/dev/urandom,/dev/random,/dev/tty).
# SHELLCTL_LANDLOCK_RW_DEV_PATHS=

16
docker/envs/core-services/local-sandbox.env.example Normal file
View File

@ -0,0 +1,16 @@
# ------------------------------
# Dify Agent Local Sandbox Configuration
# ------------------------------
# Set to false to disable Landlock path isolation (default: true).
SHELLCTL_ENABLE_PATH_ISOLATION=true
# The paths below override the built-in defaults when set, even to an empty value.
# Leave them commented out to keep the defaults; empty read-only or device path
# lists can prevent commands from running.
# Comma-separated additional read-write directories (default: none beyond $HOME).
# SHELLCTL_LANDLOCK_RW_PATHS=
# Comma-separated read-only and executable directories (default: /usr,/bin,/sbin,/lib,/lib64,/etc,/proc,/opt/dify-agent-tools,/opt/homebrew,/snap).
# SHELLCTL_LANDLOCK_RO_PATHS=
# Comma-separated read-write device files (default: /dev/null,/dev/zero,/dev/urandom,/dev/random,/dev/tty).
# SHELLCTL_LANDLOCK_RW_DEV_PATHS=