Sandbox 0.2.15 lacks ALLOWED_ENV_VARS — comfyui/workflow plugins fail with missing FILES_URL

[jiejiejie2143]

Summary

Sandbox 0.2.15 does not include the ALLOWED_ENV_VARS feature (present in main branch), causing Dify 1.14.2 plugins (e.g. comfyui) to fail when they need environment variables like FILES_URL / INTERNAL_FILES_URL in the Python subprocess sandbox.

Root Cause

In sandbox 0.2.15, internal/core/runner/python/python.go starts the Python subprocess with a fully empty environment:

cmd.Env = []string{}

Only proxy-related variables (HTTP_PROXY, HTTPS_PROXY) are appended. There is no mechanism to pass user-defined environment variables.

The main branch already has two critical code changes:

1. internal/static/config.go — reads ALLOWED_ENV_VARS env var and populates AllowedEnvVars
2. internal/core/runner/python/python.go — iterates AllowedEnvVars and passes them to the subprocess via os.Getenv

However, 0.2.15 (released 2026-04-27) predates both changes.

Impact

• Dify 1.14.2 plugins that run code in sandbox (e.g. comfyui) need FILES_URL via os.getenv() — the variable is absent → ValueError: FILES_URL environment variable is not set
• Error: {"level":"ERROR","msg":"process finished with error","status":"exit status 255"}
• Workaround requires building a custom sandbox image from main branch
• This is a version mismatch: Dify 1.14.2's recommended sandbox 0.2.15 does not support env var passthrough

Steps to Reproduce

1. Deploy Dify 1.14.2 with sandbox 0.2.15
2. Set FILES_URL and ALLOWED_ENV_VARS=FILES_URL,INTERNAL_FILES_URL in sandbox container env
3. Run a comfyui workflow that generates/retrieves images
4. Sandbox Python subprocess raises ValueError: FILES_URL environment variable is not set

Suggested Fix

Release a new sandbox version (e.g. 0.2.16) containing the ALLOWED_ENV_VARS feature already on main branch, and update Dify 1.14.2's recommended sandbox image tag accordingly.