Skip to main content
Enable sandboxed local code execution for framework: autogen runs via a single YAML flag — off by default so LLM-generated code never runs on your host without consent.
Breaking change (PR #4477). Before this fix, framework: autogen runs silently executed LLM-generated code blocks on the host with use_docker: False and human_input_mode: NEVER. Existing YAML that relied on that implicit behaviour must now opt in via config.autogen.code_execution: true. The new default is safe — no code executes unless the YAML asks for it.

​
Quick Start

1

Simple opt-in (Docker on)

Set code_execution: true — the wrapper defaults work_dir to coding and use_docker to True.
2

Custom work_dir

Pass a dict to override the sandbox directory — use_docker still defaults to True.
3

Local execution (unsafe, dev only)

Setting use_docker: false runs generated code directly on the host and logs a warning.
use_docker: false removes the sandbox. The wrapper logs a warning and executes LLM-generated code on your host. Keep Docker on outside local development.

​
How It Works

The wrapper resolves code_execution into AutoGen’s code_execution_config before it builds the UserProxyAgent. The user_proxy is constructed with the resolved code_execution_config and the resolved human_input_mode. When the LLM emits a code block, the user_proxy runs it in the sandbox path; when nothing is opted in, code_execution_config is False and no code runs.

​
Configuration Options

Every option lives under config.autogen.* in your team YAML.

​
Precedence Ladder

code_execution accepts a bool for the common case and a dict for overrides.

​
Failure Scenario

When use_docker: false the wrapper emits this warning before running code on the host:
Treat this warning as a red flag in any shared or CI environment. Re-enable Docker (use_docker: true) so untrusted LLM code stays contained.

​
Best Practices

use_docker: true (the opt-in default) sandboxes generated code. Only drop to use_docker: false on a throwaway local machine, never in CI or on a server.
Runs that previously relied on the old implicit host execution now do nothing until you add config.autogen.code_execution: true. Add it deliberately so the security posture is visible in the YAML.
Point work_dir at a disposable folder (e.g. sandbox) so generated files stay isolated and easy to clean up between runs.
TERMINATE (the new default) lets an operator step in at the end of a turn. Use NEVER for fully automated runs or ALWAYS for interactive review.

AutoGen with PraisonAI

Run AutoGen v0.2 via the family router

Tool Timeouts

Give every tool call a hard deadline