The environment variable N8N_RUNNERS_STDLIB_ALLOW=* did not take effect

[ichat001]

Bug Description

see demo:

demo.mp4

To Reproduce

1. copy docker-compose.yml
2. run docker compose up -d
3. test python code:

import sys
output = f"Python version: {sys.version}"
return {"data": output}

docker-compose.yml:

services:
  n8n:
    image: n8nio/n8n:next
    container_name: n8n
    environment:
      - N8N_RUNNERS_ENABLED=true
      - N8N_RUNNERS_MODE=external
      - N8N_RUNNERS_BROKER_LISTEN_ADDRESS=0.0.0.0
      - N8N_RUNNERS_AUTH_TOKEN=your-secret-here
      - N8N_NATIVE_PYTHON_RUNNER=true
    ports:
      - "5678:5678"
    volumes:
      - n8n_data:/home/node/.n8n

  task-runners:
    image: n8nio/runners:nightly
    container_name: n8n-runners
    environment:
      - N8N_RUNNERS_TASK_BROKER_URI=http://n8n:5679
      - N8N_RUNNERS_AUTH_TOKEN=your-secret-here
      - N8N_RUNNERS_STDLIB_ALLOW=*
      - N8N_RUNNERS_EXTERNAL_ALLOW=*
    depends_on:
      - n8n

volumes:
  n8n_data:

Expected behavior

Import of standard library module 'sys' is allow

Debug Info

Security violations detected
Line 1: Import of standard library module 'sys' is disallowed. Allowed stdlib modules: none

Operating System

docker

n8n Version

1.115.1

Node.js Version

22.19.0

Database

SQLite (default)

Execution mode

main (default)

Hosting

self hosted

[Joffcom]

Hey @ichat001,

Thank you for reaching out! We’ve received your issue and are looking into it. To help us track this internally, we’ve created a Linear ticket with the reference: "GHC-4903".

We’ll keep you updated as we make progress, but if you have any additional details or context to share, feel free to add them here - it’s always helpful!

Thanks for your patience and for bringing this to our attention.

---

For INTERNAL use only: GHC-4903

[ivov]

@ichat001 You need to allowlist the packages in the launcher's config file. Documented here.

[ichat001]

@Joffcom @ivov
Thanks for your help!
The issue has been resolved, but this isn't convenient enough—passing parameters via variables is more appropriate.

Additionally, the Python code option doesn't exist in the Code Tool node.

[ivov]

Thanks for your feedback.

[spaethtech]

Workaround for Environment Variable Issue**

We encountered a similar issue where environment variables configured in n8n-task-runners.json allowed-env were not available in Python code execution.

Root Cause:
The Python task runner (/opt/runners/task-runner-python/src/task_executor.py) calls os.environ.clear() in both _all_items() and _per_item() methods, which removes all environment variables that were already filtered and passed through by the launcher based on n8n-task-runners.json configuration.

Our Fix:
We patched task_executor.py to comment out the os.environ.clear() calls, since the environment has already been properly filtered by the launcher:

# File: /opt/runners/task-runner-python/src/task_executor.py
# Lines ~180 and ~221 (in both _all_items and _per_item methods)

# Original:
        os.environ.clear()

# Patched to:
        # Environment already filtered by launcher based on runners.json
        # os.environ.clear()

This allows environment variables specified in n8n-task-runners.json allowed-env to be accessible in Python code execution without modifying the security model (the launcher still controls which vars are allowed).

Implementation:
We apply this patch in our Dockerfile using a Python script for clean, maintainable patching.