JS Executor Microservice

Microservice for secure JavaScript code execution in an isolated environment using isolated-vm. Ideal for use as a code execution backend, sandbox, or integration with systems that need to evaluate JS in a controlled way.

Features

• Executes JavaScript code securely and in isolation
• Configurable memory and execution time limits
• Blocks dangerous patterns (require, import, process, global, console.log)
• Endpoints protected by secret header and origin validation
• Healthcheck endpoint for monitoring

Endpoints

POST /execute

Executes JS code sent in the request body.

Required headers:

• X-API-Secret: secret key defined in the JS_EXECUTOR_SECRET environment variable
• Content-Type: application/json

Body:

{
  "code": "return 1 + 1;"
}

Response:

{
  "result": 2
}

GET /health

Returns the service status. Also requires authentication.

How to run with Docker Compose

1. Copy .env.example to .env and adjust variables if needed.
2. Run:

   docker-compose up --build

3. The service will be available at http://localhost:3217.

Environment variables

• JS_EXECUTOR_SECRET: secret key for authentication (required)
• ALLOWED_ORIGINS: allowed origins for requests (optional)

Testing

Use the server-test.bash script to test all endpoints and use cases:

bash server-test.bash

Security

• Isolated execution with memory limit
• Blocks dangerous patterns
• Mandatory authentication
• Origin validation