Dynamic Worker Runner
Execute untrusted JavaScript via Dynamic Workers with no network access
Run untrusted JavaScript as an ES module Worker using the Worker Loader API. Loaded workers run with globalOutbound: null so they cannot make network requests.
API Reference
POST /run
Execute a Worker module string and return its HTTP response status and body.
code string (required)
Full ES module that exports default { fetch }. Max length 10,000 characters.
Example Request
curl -X POST "https://your-worker.workers.dev/run" \
-H "Content-Type: application/json" \
-d '{"code":"export default { async fetch() { return Response.json({ hello: \"world\" }); } }"}'Success Response
{
"status": 200,
"body": { "hello": "world" }
}Error Codes
400- Missing, empty, or too-long code (INVALID_CODE)502- Loader or isolate failure (RUN_ERROR)
Use Cases
- Learn Dynamic Workers / Worker Loader patterns safely
- Sandbox plugin or customer code without outbound network
- Prototype multi-tenant execution before Workers for Platforms
- Teach isolate isolation and
globalOutboundrestrictions
Limitations
- Code must be a complete ES module with
default { fetch } - Max code length 10,000 characters
- No outbound network from the loaded worker
- Dynamic Workers / Worker Loader may require account entitlements
Deployment
Deploy
Ensure your account supports Worker Loaders. wrangler.json binds LOADER via worker_loaders.
Test your deployment
curl -X POST "https://your-worker.workers.dev/run" \
-H "Content-Type: application/json" \
-d '{"code":"export default { async fetch() { return Response.json({ ok: true }); } }"}'Local Development
cd apps/experiments/dynamic-worker-runner
npm install
npm run devcurl -X POST "http://localhost:8787/run" \
-H "Content-Type: application/json" \
-d '{"code":"export default { async fetch() { return Response.json({ hello: \"world\" }); } }"}'Configuration
wrangler.json declares:
- Worker Loader binding
LOADER
Cloudflare Features Used
- Workers - Edge compute runtime
- Dynamic Workers / Worker Loaders - Load and run module code at request time