Overview
The Functions Microservice provides a secure, isolated environment for running custom code within the Prisme.ai platform. It supports:- NodeJS Functions: JavaScript code execution with access to selected built-in modules
- Python Functions: Python code execution with standard library access
- Shared Execution Context: Functions within the same workspace can call each other
- Memory Management: Configurable resource limits and garbage collection
- Dependency Management: Automatic installation of required packages
The Functions Microservice is designed with security in mind, running code in isolated environments with configurable resource limits to prevent abuse or resource exhaustion.
Installation Prerequisites
Before deploying the Functions Microservice, ensure you have:Storage Volume
The service requires a volume for storing code, dependencies, and execution data. We recommend using volumes with high I/O performance as they may experience heavy usage when installing dependencies.
Optional: NPM Registry Access
Optional: NPM Registry Access
A set of commonly used JavaScript packages (node-fetch, js-yaml, dayjs, mongodb, redis, sharp, etc.) are pre-installed in the Docker image and shared across all workspaces. This means no npm registry access is required for most use cases.If your custom code requires additional packages beyond the pre-installed ones, the service must have access to a npm registry. You can:
- Set
NPM_CONFIG_REGISTRYto point to your own registry - Or set the workspace
disableNpmRegistryoption totrueto prevent any runtime npm install entirely (only pre-installed shared packages will be available)
Configuration
Environment Variables
Configure the Functions Microservice with the following environment variables:Python Configuration
Python Configuration
| Variable Name | Description | Default Value |
|---|---|---|
PYTHON_FUNCTIONS_RUN_TIMEOUT | Python functions execution timeout in milliseconds | 20000 |
PYTHON_API_URL | Python API URL | http://localhost:8000 |
KERNEL_POOL_SIZE | Number of python processes (each thread can execute only 1 function at a time) | Defaults to current cpu cores number |
PYTHON_BUILTIN_MODULES | Comma-separated list of allowed Python stdlib modules for import. Dangerous modules like subprocess, os, socket, ctypes are excluded by default. See default list below. | See below |
PYTHON_PACKAGES_AUTO_INSTALL | Comma-separated list of pip packages to install at startup (supports version notation like pandas==2.0.0) | |
PYTHON_PACKAGES_DIR | Path to the custom python packages install directory | data/functions-py/packages/ |
PYTHON_PACKAGES_WHITELIST_IMPORT | Comma-separated list of allowed third-party packages for import. | numpy, pandas, tabulate, dateparser, urllib3, requests, pptx, docx |
Default PYTHON_BUILTIN_MODULES
The following stdlib modules are allowed by default, organized by category:| Category | Modules |
|---|---|
| Data formats & serialization | json, csv, xml, html, email |
| Text & strings | re, string, textwrap, unicodedata, difflib |
| Math & numbers | math, decimal, fractions, random, statistics |
| Date & time | datetime, time, calendar |
| Data structures & functional | collections, itertools, functools, operator, array, heapq, bisect, queue, copy |
| Types & classes | enum, typing, dataclasses, abc, types |
| I/O & paths | io, pathlib, tempfile, glob, fnmatch |
| Encoding & hashing | base64, hashlib, hmac, binascii, struct, secrets |
| Compression & archives | zlib, gzip, bz2, lzma, zipfile, tarfile |
| Network (high-level only) | urllib, http |
| Logging & debugging | logging, warnings, traceback, pprint |
| Misc | uuid, contextlib, weakref, timeit, atexit |
NodeJS Configuration
NodeJS Configuration
| Variable Name | Description | Default Value |
|---|---|---|
PORT | HTTP port for the service | 4000 |
FUNCTIONS_STORAGE_FILESYSTEM_DIRPATH | Directory path for function storage | data/functions/ |
FUNCTIONS_RUN_TIMEOUT | Functions execution timeout in milliseconds | 20000 |
FUNCTIONS_WORKERS_MAX_LRU | Maximum number of function workers kept in memory | 500 |
NODEJS_BUILTIN_MODULES | Comma-separated list of allowed Node.js built-in modules | http, https, url, util, zlib, dns, stream, buffer, crypto |
NODEJS_PACKAGES_WHITELIST_IMPORT | Comma-separated list of allowed external packages for require() and install. When not set, all packages are allowed. Automatically combined with NODEJS_SHARED_PACKAGES_WHITELIST_IMPORT so that shared packages remain accessible. | |
NODEJS_SHARED_PACKAGES_WHITELIST_IMPORT | Comma-separated list of shared packages always allowed for require(), in addition to NODEJS_PACKAGES_WHITELIST_IMPORT. Defaults to all packages detected in SHARED_NODE_MODULES_DIRECTORY. | Auto-detected from shared deps |
NODEJS_PACKAGES_BLACKLIST_IMPORT | Comma-separated list of blocked npm packages for install and require(). Takes precedence over whitelists. | |
SHARED_NODE_MODULES_DIRECTORY | Path to a directory containing a package.json and pre-installed node_modules/ shared across all workspaces. Packages in this directory are available to all custom code functions without per-workspace npm install. | /www/custom-js-deps (in Docker) |
NPM_CONFIG_REGISTRY | NPM registry URL | https://registry.npmjs.org/ |
NODE_WORKER_MAX_OLD_GENERATION_SIZE_MB | NodeJS function worker maxOldGenerationSizeMb | 100 |
INACTIVE_NODE_WORKER_DELETION_TIMEOUT | Inactive period in seconds after which node workers are automatically terminated | 3600 |
UPDATE_SCRIPTS_ON_STARTUP | If set to “yes” or “true”, ensures function scripts are in-sync with corresponding workspace.yaml files on startup | no |
REQUEST_MAX_SIZE | Maximum request body size (format from bodyParser.json) | 1mb |
Default NODEJS_SHARED_PACKAGES_WHITELIST_IMPORT
The following packages are pre-installed and shared across all workspaces by default:| Category | Packages |
|---|---|
| Authentication & security | @azure/msal-node, google-auth-library, hcaptcha |
| AI & text processing | gpt-tokenizer |
| Data formats & parsing | csv-parse, csv-string, js-yaml, yaml, papaparse, safe-flat, uni-flatten |
| Email & messaging | @sendgrid/mail |
| Database & caching | mongodb, redis |
| HTTP & networking | node-fetch, form-data |
| Files & archives | adm-zip, archiver, sharp |
| Text & encoding | css, iconv-lite, jschardet, striptags, sift |
| Utilities | dayjs, generate-password, human-readable-ids, humanize-duration, md5, short-uuid, unique-names-generator |
All transitive dependencies of these packages are also available for import. The effective shared whitelist is auto-detected from the
node_modules/ directory, not just the direct dependencies listed above.Resource Considerations
When deploying the Functions Microservice, consider the following resource recommendations:Memory Allocation
Allocate sufficient memory based on your expected workload:
- Minimum: 1GB
- Recommended: 2GB or more for production environments
- Consider additional memory if functions will process large datasets
CPU Resources
Ensure adequate CPU resources:
- Minimum: 0.5 vCPU
- Recommended: 1 vCPU or more for production environments
- Functions with complex calculations may benefit from additional CPU
Disk Space
Plan for storage requirements:
- Minimum: 1GB
- Recommended: 5GB or more for environments with many dependencies
- Consider storage needs for dependency caching and function code
Network Configuration
Ensure proper network setup:
- Accessible by other microservices (especially API Gateway)
- Access to required external resources (NPM registry, etc.)
- Consider network policies for security
Microservice Testing
After deploying the Functions Microservice, verify its operation with these simple tests:Create a Test Function
Create a function workspace named If successful, the same body should be returned in the response.
test containing a hello function:Execute the Function
Run the function with a test parameter:If successful, you should receive a response like:
Advanced Features
The Functions Microservice includes several advanced capabilities that enhance its flexibility and power:Asynchronous Functions
Asynchronous Functions
All functions are executed as asynchronous operations, even if they don’t explicitly use async calls. This means:
- Every function is treated as if it had the
asynckeyword - When calling functions from the same workspace, you must use the
awaitkeyword - Results are always returned as promises
Shared Execution Context
Shared Execution Context
Shared Memory Cache
Shared Memory Cache
Dependency Management
Dependency Management
Functions can use external dependencies by specifying them in the function definition:
- NodeJS functions can use NPM packages. Dependencies are resolved in the following order:
- Shared dependencies (pre-installed at build time): A set of commonly needed packages are bundled in the Docker image under
SHARED_NODE_MODULES_DIRECTORYand available to all workspaces instantly, without any npm install at runtime. These include packages likelodash,axios,dayjs,mongodb,redis,sharp, and more. - Per-workspace dependencies: Any additional package required by a workspace’s custom code that is not in the shared dependencies will be automatically installed via npm when the function is created or updated. This can be disabled per workspace with the
disableNpmRegistryoption.
- Shared dependencies (pre-installed at build time): A set of commonly needed packages are bundled in the Docker image under
- Python functions can use PyPI packages that have been whitelisted and pre installed with the corresponding environment variables
NODEJS_PACKAGES_WHITELIST_IMPORT is set, shared packages are automatically added to the effective whitelist so that platform-native custom code continues to work without requiring clients to explicitly list every shared package.Example NodeJS function with dependencies:Integration with Prisme.ai
The Functions Microservice integrates with other Prisme.ai components:AI Builder
Within AI Builder, you can create custom automations that execute functions, allowing you to extend workflows with custom logic.
AI Knowledge
Custom functions can be used as tools in AI Knowledge agents, enabling them to perform specialized operations like data transformation or external API calls.
AI Store
Functions can power features in agents published to the AI Store, adding custom capabilities to shared agents.
Custom Code App
The Custom Code app provides a user-friendly interface for managing, testing, and monitoring functions.
Security Considerations
When deploying and using the Functions Microservice, keep these security considerations in mind:Code Isolation
Functions run in isolated environments to prevent interference between different workspaces and functions.
Resource Limits
Configure appropriate resource limits to prevent denial-of-service attacks or resource exhaustion.
Access Control
Implement proper authentication and authorization to control who can create and execute functions.
Dependency Scanning
Consider scanning dependencies for vulnerabilities before allowing their installation.
Troubleshooting
Function Creation Fails
Function Creation Fails
Possible causes:
- Invalid function code syntax
- Unavailable or incompatible dependencies
- Insufficient disk space for dependencies
- Network issues preventing access to the NPM registry
- Check the service logs for specific error messages
- Verify NPM registry access from within the container
- Ensure sufficient disk space in the function storage volume
- Validate function syntax before submission
Function Execution Timeouts
Function Execution Timeouts
Possible causes:
- Function code contains infinite loops or excessive processing
- Timeout setting is too low for the operation
- External service calls that take too long
- Review function code for inefficiencies or infinite loops
- Adjust the
FUNCTIONS_RUN_TIMEOUTorPYTHON_FUNCTIONS_RUN_TIMEOUTsetting - Implement better error handling for external service calls
- Consider breaking complex operations into smaller, chainable functions
Memory-Related Errors
Memory-Related Errors