# JavaScript - Workflow node | Docs - nodulz

Source: https://nodulz.com/docs/nodes/code

Language: en

Run JavaScript in a local sandbox or a Docker or Podman container.

## Usage and specifics

Sandbox mode runs JavaScript locally with a timeout, allowed hosts and selected secret credentials. Docker mode uses source and executionTarget. A sandbox does not provide all container capabilities.

Technical type : `code`. Runtime : `nodulz`.

## Credentials and prerequisites

This node defines no dedicated external credential. Remote sources or execution targets may still need their own access credentials.

See the [credentials guide](/docs/credentials) if a remote source or execution target requires access.

## Parameters

Names below are technical keys. Defaults are not a ready-to-run configuration: complete fields required by your operation. Paths containing [] describe list items; some fields depend on the selected mode.

| Parameter | Type | Default | Values / limits |
| --- | --- | --- | --- |
| `files` | `record` | - | - |
| `directories` | `array` | - | -; max 100 |
| `dependencies` | `array` | `[]` | -; max 16 |
| `libraryIds` | `array` | - | -; max 100 |
| `executionMode` | `literal` | `"sandbox"` | `sandbox`, `docker` |
| `code` | `string` | `"const name = input.name ?? \"world\";\nreturn { message: `Hello ${name}`, nodeKeys: Object.keys(nodes) };"` | - |
| `timeoutMs` | `number` | `10000` | -; ≥ 100, ≤ 120000 |
| `allowedHosts` | `array` | `[]` | - |
| `secretCredentialIds` | `array` | `[]` | - |
| `source` | `union` | - | - |
| `source.files` | `record` | - | - |
| `source.directories` | `array` | - | -; max 100 |
| `source.kind` | `literal` | - | `inline`, `git`, `workspace` |
| `source.script` | `string` | - | - |
| `source.dependencies` | `array` | - | - |
| `source.repo` | `string` | - | -; min 1 |
| `source.branch` | `string` | `"main"` | -; min 1 |
| `source.scriptPath` | `string` | - | -; min 1 |
| `source.credentialId` | `string` | - | - |
| `source.installRoot` | `string` | - | - |
| `source.installCommand` | `string` | - | - |
| `source.workingDir` | `string` | - | - |
| `image` | `string` | - | - |
| `workspaceSource` | `union` | - | - |
| `workspaceSource.kind` | `literal` | - | `upstream`, `node` |
| `workspaceSource.key` | `string` | - | -; min 1 |
| `executionTarget` | `union` | `{"kind":"host"}` | - |
| `executionTarget.kind` | `literal` | `"host"` | `aws_ecs`, `aws_lambda`, `gcp_job`, `gcp_function`, `azure_container`, `azure_function`, `scaleway_job`, `scaleway_function`, `scaleway_container`, `digitalocean_function`, `host`, `remote_server`, `kube`, `swarm` |
| `executionTarget.credentialId` | `string` | - | -; min 1, max 512 |
| `executionTarget.storageCredentialId` | `string` | - | -; min 1, max 512 |
| `executionTarget.bucket` | `string` | - | - |
| `executionTarget.region` | `string` | - | `fr-par`, `nl-ams`, `pl-waw`; max 64 |
| `executionTarget.cluster` | `string` | - | -; min 1, max 512 |
| `executionTarget.taskDefinition` | `string` | - | -; min 1, max 512 |
| `executionTarget.containerName` | `string` | - | -; max 100 |
| `executionTarget.subnets` | `array` | - | -; min 1, max 16 |
| `executionTarget.securityGroups` | `array` | `[]` | -; max 5 |
| `executionTarget.assignPublicIp` | `boolean` | `false` | - |
| `executionTarget.functionName` | `string` | - | -; min 1, max 256 |
| `executionTarget.project` | `string` | - | -; max 100 |
| `executionTarget.jobName` | `string` | - | -; max 100 |
| `executionTarget.endpoint` | `string` | - | -; max 512 |
| `executionTarget.subscriptionId` | `string` | - | - |
| `executionTarget.resourceGroup` | `string` | - | -; max 90 |
| `executionTarget.functionApp` | `string` | - | -; max 100 |
| `executionTarget.jobId` | `string` | - | - |
| `executionTarget.functionId` | `string` | - | - |
| `executionTarget.containerId` | `string` | - | - |
| `executionTarget.namespaceId` | `string` | - | - |
| `executionTarget.serverId` | `string` | - | -; min 1 |
| `executionTarget.provider` | `enum` | - | `aws`, `gcp`, `scaleway`, `ovh`, `azure`, `digitalocean`, `hetzner` |
| `executionTarget.clusterId` | `string` | - | -; min 1 |
| `executionTarget.namespace` | `string` | - | - |

## Configuration help

| Setting | Purpose and guidance |
| --- | --- |
| `executionMode`<br>Execution mode | Each mode keeps its own script and settings. The sandbox runs a function body or a run(context) module, with network access limited to allowed hosts. Container or cloud runs a module exporting run(context) through the selected provider: local Docker/Podman, an SSH server, a managed container or a cloud function (such as Lambda). Dependencies, files and network access depend on the provider runtime; sandbox host restrictions do not apply. |
| `dependencies`<br>Dependencies | Public npm packages via esm.sh, one per line with an exact version (e.g. lodash-es@4.17.21). Import the package name or use await import(). Only compatible JavaScript modules are available: no native addons, files or Node APIs. The initial download counts toward the timeout; sources are then cached. |
| `timeoutMs`<br>Timeout | Past this delay the node fails, including during a fetch or a sleep. |
| `allowedHosts`<br>Hosts allowed for fetch | One per line: api.example.com, *.example.com for subdomains, or * for any public host. Empty: fetch is disabled. Private and internal addresses are always refused. |
| `secretCredentialIds`<br>Secrets | Secrets connections whose variables are readable in secrets and process.env. Their values are masked in logs. |

## Initial configuration

Initial catalog configuration example, to adapt before running. Keep secrets in credentials.

```json
{
  "executionMode": "sandbox",
  "code": "const name = input.name ?? \"world\";\nreturn { message: `Hello ${name}`, nodeKeys: Object.keys(nodes) };",
  "timeoutMs": 10000,
  "allowedHosts": [],
  "secretCredentialIds": []
}
```

## Verification

Test with representative data. Check node output in the inspector and logs, then use editor mapping for downstream fields. A trigger test with a simulated payload does not validate external service delivery.

See also : [Expressions and data](/docs/expressions), [Executions](/docs/executions), [Node catalog](/docs/nodes).

## Explore further

- [Features - nodulz](https://nodulz.com/product/overview)
- [Node catalog - nodulz](https://nodulz.com/product/catalog)
- [MCP server - nodulz](https://nodulz.com/product/mcp)
- [Pricing - nodulz](https://nodulz.com/pricing)
- [Use cases and workflow automation - nodulz](https://nodulz.com/use-cases)
- [Choose what your workflows can do. - nodulz](https://nodulz.com/compare)
- [Documentation - nodulz](https://nodulz.com/docs)