JavaScript

Node catalog Scripts

On this page

Run JavaScript in a local sandbox or a Docker or Podman container.

Usage and specifics

Sandbox mode runs JavaScript locally with a timeout, allowed hosts and selected secret credentials. Docker mode uses source and executionTarget. A sandbox does not provide all container capabilities.

Technical type : code. Runtime : nodulz.

Credentials and prerequisites

This node defines no dedicated external credential. Remote sources or execution targets may still need their own access credentials.

See the credentials guide if a remote source or execution target requires access.

Parameters

Names below are technical keys. Defaults are not a ready-to-run configuration: complete fields required by your operation. Paths containing [] describe list items; some fields depend on the selected mode.

Parameter	Type	Default	Values / limits
`files`	`record`	-	-
`directories`	`array`	-	-; max 100
`dependencies`	`array`	`[]`	-; max 16
`libraryIds`	`array`	-	-; max 100
`executionMode`	`literal`	`"sandbox"`	`sandbox`, `docker`
`code`	`string`	`"const name = input.name ?? \"world\";\nreturn { message:` Hello ${name}`, nodeKeys: Object.keys(nodes) };"`	-
`timeoutMs`	`number`	`10000`	-; ≥ 100, ≤ 120000
`allowedHosts`	`array`	`[]`	-
`secretCredentialIds`	`array`	`[]`	-
`source`	`union`	-	-
`source.files`	`record`	-	-
`source.directories`	`array`	-	-; max 100
`source.kind`	`literal`	-	`inline`, `git`, `workspace`
`source.script`	`string`	-	-
`source.dependencies`	`array`	-	-
`source.repo`	`string`	-	-; min 1
`source.branch`	`string`	`"main"`	-; min 1
`source.scriptPath`	`string`	-	-; min 1
`source.credentialId`	`string`	-	-
`source.installRoot`	`string`	-	-
`source.installCommand`	`string`	-	-
`source.workingDir`	`string`	-	-
`image`	`string`	-	-
`workspaceSource`	`union`	-	-
`workspaceSource.kind`	`literal`	-	`upstream`, `node`
`workspaceSource.key`	`string`	-	-; min 1
`executionTarget`	`union`	`{"kind":"host"}`	-
`executionTarget.kind`	`literal`	`"host"`	`aws_ecs`, `aws_lambda`, `gcp_job`, `gcp_function`, `azure_container`, `azure_function`, `scaleway_job`, `scaleway_function`, `scaleway_container`, `digitalocean_function`, `host`, `remote_server`, `kube`, `swarm`
`executionTarget.credentialId`	`string`	-	-; min 1, max 512
`executionTarget.storageCredentialId`	`string`	-	-; min 1, max 512
`executionTarget.bucket`	`string`	-	-
`executionTarget.region`	`string`	-	`fr-par`, `nl-ams`, `pl-waw`; max 64
`executionTarget.cluster`	`string`	-	-; min 1, max 512
`executionTarget.taskDefinition`	`string`	-	-; min 1, max 512
`executionTarget.containerName`	`string`	-	-; max 100
`executionTarget.subnets`	`array`	-	-; min 1, max 16
`executionTarget.securityGroups`	`array`	`[]`	-; max 5
`executionTarget.assignPublicIp`	`boolean`	`false`	-
`executionTarget.functionName`	`string`	-	-; min 1, max 256
`executionTarget.project`	`string`	-	-; max 100
`executionTarget.jobName`	`string`	-	-; max 100
`executionTarget.endpoint`	`string`	-	-; max 512
`executionTarget.subscriptionId`	`string`	-	-
`executionTarget.resourceGroup`	`string`	-	-; max 90
`executionTarget.functionApp`	`string`	-	-; max 100
`executionTarget.jobId`	`string`	-	-
`executionTarget.functionId`	`string`	-	-
`executionTarget.containerId`	`string`	-	-
`executionTarget.namespaceId`	`string`	-	-
`executionTarget.serverId`	`string`	-	-; min 1
`executionTarget.provider`	`enum`	-	`aws`, `gcp`, `scaleway`, `ovh`, `azure`, `digitalocean`, `hetzner`
`executionTarget.clusterId`	`string`	-	-; min 1
`executionTarget.namespace`	`string`	-	-

Configuration help

executionMode Execution mode: Each mode keeps its own script and settings. The sandbox runs a function body or a run(context) module, with network access limited to allowed hosts. Container or cloud runs a module exporting run(context) through the selected provider: local Docker/Podman, an SSH server, a managed container or a cloud function (such as Lambda). Dependencies, files and network access depend on the provider runtime; sandbox host restrictions do not apply.
dependencies Dependencies: Public npm packages via esm.sh, one per line with an exact version (e.g. [email protected]). Import the package name or use await import(). Only compatible JavaScript modules are available: no native addons, files or Node APIs. The initial download counts toward the timeout; sources are then cached.
timeoutMs Timeout: Past this delay the node fails, including during a fetch or a sleep.
allowedHosts Hosts allowed for fetch: One per line: api.example.com, *.example.com for subdomains, or * for any public host. Empty: fetch is disabled. Private and internal addresses are always refused.
secretCredentialIds Secrets: Secrets connections whose variables are readable in secrets and process.env. Their values are masked in logs.

Initial configuration

Initial catalog configuration example, to adapt before running. Keep secrets in credentials.

json

{
  "executionMode": "sandbox",
  "code": "const name = input.name ?? \"world\";\nreturn { message: `Hello ${name}`, nodeKeys: Object.keys(nodes) };",
  "timeoutMs": 10000,
  "allowedHosts": [],
  "secretCredentialIds": []
}

Verification

Test with representative data. Check node output in the inspector and logs, then use editor mapping for downstream fields. A trigger test with a simulated payload does not validate external service delivery.