Skip to content

Code Execution

OMD Cleo provides a managed Python code execution sandbox powered by Temporal. The agent can run Python code on demand or on a schedule — without requiring any infrastructure on your side.

How it works

Code execution runs inside a dedicated Temporal worker container. Temporal provides:

  • Durability — workflow executions survive worker restarts and infrastructure failures.
  • Retries — failed activities are automatically retried with configurable backoff.
  • Scheduling — cron-like schedules for recurring code execution.
  • Observability — execution history and status visible in the Temporal UI.

Available tools

Tool Description
run_python_code Execute a Python snippet ad hoc and return the result
schedule_python_code Register a Python snippet as a recurring scheduled job

Ad-hoc execution

The agent calls run_python_code to perform calculations, data transformations, or any logic that is easier to express as code than as a prompt. The code runs in a sandboxed Python environment and the result is returned to the agent.

Example: A user asks for a custom aggregation not directly available via OData or SQL. The agent retrieves the raw data via an OMD tool and then runs a Python snippet to compute the aggregation.

Scheduled execution

The agent calls schedule_python_code to register a Python snippet as a cron job. Scheduled jobs are stored in the database and managed by the Temporal worker.

Example: A tenant wants to generate and email a custom weekly report every Monday morning. The agent creates a scheduled job that fetches the data, formats it, and sends an email — all without manual intervention.

Managing schedules

Schedules can be listed, updated, and cancelled via:

  • The /schedules API endpoint.
  • The Cleo admin frontend (Automations tab).

Security

  • Code runs inside an isolated Temporal activity with no access to the host file system or network beyond what the sandbox allows.
  • The sandbox is not exposed directly to end users; it is invoked only by the agent as part of a workflow.
  • Output is captured and returned to the agent; it is not persisted independently.

Infrastructure

The Temporal worker runs as a separate Docker container (Dockerfile.worker). Full Kubernetes manifests are included in omd-agents/k8s/. The Temporal server itself is also deployed as part of the Cleo Kubernetes stack.