Apart from API Maker
An endless loop, a crash or a memory leak in your code stays in its container. API Maker keeps serving the other requests.
Security
Secure Sandbox
Your code runs in Docker containers, apart from API Maker, with time limits and automatic replacement.
Custom APIs, hooks, event listeners, schedulers, migrations and test cases run in sandbox containers, not in the API Maker process. Every run has a time limit, a stuck sandbox is replaced, and each account builds its own image with the npm packages it needs.
See it live
Step through it, slow it down, or open the full canvas.
api-maker/features/secure-sandboxLive- Timeout
- 13000ms, default
- Sandboxes
- 2running
- Replaced
- 0after a timeout
- User code
- 0in API Maker
Your code runs outside API Maker. Custom APIs, hooks, event listeners, schedulers, migrations and test cases run in Docker containers. The worker sends the code and the request over TCP and gets the output back.
How it works
Your code runs outside API Maker.
Custom APIs, hooks, event listeners, schedulers, migrations and test cases run in Docker containers. The worker sends the code and the request over TCP and gets the output back.
Data comes through API Maker.
When your code calls g.sys.db.query, the call goes back to the worker, which runs the real API with its checks, and returns the rows to the sandbox.
Every run has a time limit.
13 seconds by default. Change it per request with the x-am-sandbox-timeout header, or in the settings of a custom API, a scheduler or a listener.
A stuck sandbox is replaced.
It gets no new requests, the ones inside it finish, then it is removed and a new sandbox takes its place. The time to get a sandbox is not counted in the logs.
Your own image, your own packages.
Each admin user gets a sandbox image built from a Dockerfile and the npm packages you add. Restart all sandboxes and they start from the new image.
Tune it to your load.
Sandboxes per worker, a restart every N seconds, a separate sandbox for a heavy API, or the native process for code you trust.
What you get
Time and memory limits
Every run has a time limit, per request or per API. Each sandbox has a heap limit: sandboxMaxOldSpaceMB, or the larger of 2500 MB and the memory of the server divided by its CPU count.
Replaced, not restarted in place
A sandbox that times out gets no new requests, the ones inside it finish, and a new one takes its place. You can also restart sandboxes every N seconds.
Your image
Add npm packages in the sandbox settings, edit the Dockerfile, and the image of your account is built with them.
Separate sandbox groups
Give a heavy custom API a sandbox group of its own, with its own packages, Dockerfile and restart interval.
Real debugging
Turn on debugging and attach Chrome DevTools to the sandbox: breakpoints, steps and variables in your TypeScript.
An example
A heavy report next to fast APIs
Generating PDFs needs a big package and a lot of memory. In its own sandbox group, it gets its package and restarts every hour, while every other API keeps its small, fast sandboxes.
import * as T from 'types';let customApi: T.ICustomApiSettingsTypes = { name: 'Invoice PDF', requestMethod: T.ERequestMethod.POST, path: '/invoice-pdf', customApiTimeoutInSeconds: 60, separateSandboxSettings: { enableSeparateSandboxForThis: 'pdf_group', packages: { allowAllPackagesOfAdmin: false, sandboxPackages: [{ name: 'pdfkit', version: '0.15.0' }] }, autoRestart: { afterTheseMuchSeconds: 3600 }, }, errorList: [],};module.exports = customApi;Good to know
- runOnNativeProcess skips the sandbox: code then runs inside API Maker, with its packages, and can slow the whole server.
- Sandbox containers need Docker on the server. The installer sets it up.
- The containers are started privileged, so treat the sandbox as a guard against faulty code, not against hostile code: only give code access to people you trust.
Questions
How many sandboxes run?
Each API Maker process keeps a pool per account, sandboxCountForAdmin containers, and a pool per sandbox group. Requests wait in a queue when all of them are busy.
How does code in the sandbox reach my databases?
Through g.sys.db. The call goes back to API Maker, which runs the real API with its checks and returns the rows.
Can I change the time limit of one call?
Yes. Send x-am-sandbox-timeout in milliseconds, or set the limit in the settings of the custom API, scheduler or listener.