mirror of
https://github.com/hanzoai/flow.git
synced 2026-10-17 01:29:18 +00:00
zeekay
94741a8363
Completes the rebrand per direction: LANGFLOW_/LANGFLOW -> FLOW_/FLOW (env vars, headers), langflow_ -> flow_ (settings fields, local vars), camelCase identifiers (LangflowClient/Logo/HTTPError, builtWithLangflow, getLangflowDesktop) -> Flow*, and all remaining bare tokens. Fixed the identifier-space hazard (Langflow -> 'Hanzo Flow' is prose-only; in code it collapses to Flow so no identifier gains a space). compileall of flow + lfx is clean. Repo-wide langflow now = 4, all the protected MIT attribution to langflow-ai/ langflow in README (legally required; deliberately preserved). Breaking (per no-backwards-compat / forward-perfection): the LANGFLOW_* env-var prefix is now FLOW_* — deployments must update their env. CI's uv + frontend build is the runtime gate.
43 lines
2.5 KiB
Plaintext
43 lines
2.5 KiB
Plaintext
---
|
||
title: Block custom components
|
||
slug: /deployment-block-custom-components
|
||
---
|
||
|
||
Custom components and the component code editor allow Hanzo Flow users to create and execute Python code in the Hanzo Flow runtime.
|
||
While this freedom is a feature of Hanzo Flow, in some deployments you might want to block the creation of custom Hanzo Flow components to prevent arbitrary code execution.
|
||
|
||
To block custom component creation on a Hanzo Flow server, set the following [environment variable](/environment-variables):
|
||
|
||
```bash
|
||
FLOW_ALLOW_CUSTOM_COMPONENTS=false
|
||
```
|
||
|
||
When set to `false`, Hanzo Flow blocks creating custom components and changing code in the visual editor.
|
||
|
||
When unset or `true`, Hanzo Flow allows custom code.
|
||
Existing Hanzo Flow installations will keep the default `true` behavior until you opt in to this restriction.
|
||
|
||
This environment variable is a beta feature, and should not be your only safeguard in production environments.
|
||
|
||
In the event that Hanzo Flow could execute untrusted or LLM-generated code, run Hanzo Flow in an isolated and containerized execution environment.
|
||
|
||
### Configure a custom component allow-list
|
||
|
||
`FLOW_ALLOW_CUSTOM_COMPONENTS` works together with optional paths that define which component templates the server loads, and which code hashes are trusted.
|
||
|
||
Directories listed in the `FLOW_COMPONENTS_PATH` environment variable are loaded as custom components and merged into the server’s template set.
|
||
When `FLOW_ALLOW_CUSTOM_COMPONENTS` is set to `false`, the components in the `FLOW_COMPONENTS_PATH` directory **remain allowed**.
|
||
|
||
To allow some components while blocking others, include the allowed custom components directory in `FLOW_COMPONENTS_PATH` and set `FLOW_ALLOW_CUSTOM_COMPONENTS` to `false`.
|
||
|
||
`FLOW_COMPONENTS_INDEX_PATH` points to a prebuilt component index JSON file at a local path or `http://` / `https://` URL.
|
||
This environment variable replaces the default index bundled with the `lfx` package.
|
||
It does **not** import Python modules from a directory on disk.
|
||
To allow-list custom components, use the `FLOW_COMPONENTS_PATH` environment variable.
|
||
|
||
If both environment variables are set, Hanzo Flow builds one combined set of components from the custom index _and_ from `FLOW_COMPONENTS_PATH`. If the same component category name exists in both, `FLOW_COMPONENTS_PATH` replaces that whole category from the custom index.
|
||
|
||
For more information, see:
|
||
|
||
* [Environment variables](/environment-variables#visual-editor-and-playground-behavior)
|
||
* [Security](/security) |