fix: use pnpm and task-runners.json for runner npm packages

n8nio/runners image uses pnpm, not npm. configure allowed modules
via n8n-task-runners.json instead of environment variables.

- switch from npm to pnpm in Dockerfile.runner
- add n8n-task-runners.json for module allowlist config
- remove redundant env vars from docker-compose.yml
- update documentation to reflect new config location

CLAUDE.md

@@ -100,11 +100,10 @@ Follow this workflow when adding a new optional service (refer to `.cursor/rules
   - Runner connects to its worker via `network_mode: "service:n8n-worker-N"` (localhost:5679)
   - Runner image `n8nio/runners` must match n8n version
 - **Scaling**: Change `N8N_WORKER_COUNT` in `.env` and run `bash scripts/generate_n8n_workers.sh`
-- **Code node libraries**: Configured on the runner container (not n8n):
-  - `NODE_FUNCTION_ALLOW_EXTERNAL`: JS packages (`cheerio`, `axios`, `moment`, `lodash`)
-  - `NODE_FUNCTION_ALLOW_BUILTIN`: Node.js built-in modules (`*` = all)
-  - `N8N_RUNNERS_STDLIB_ALLOW`: Python stdlib modules
-  - `N8N_RUNNERS_EXTERNAL_ALLOW`: Python third-party packages
+- **Code node libraries**: Configured via `n8n/n8n-task-runners.json` and `n8n/Dockerfile.runner`:
+  - JS packages installed via `pnpm add` in Dockerfile.runner
+  - Allowlist configured in `n8n-task-runners.json` (`NODE_FUNCTION_ALLOW_EXTERNAL`, `NODE_FUNCTION_ALLOW_BUILTIN`)
+  - Default packages: `cheerio`, `axios`, `moment`, `lodash`
 - Workflows can access the host filesystem via `/data/shared` (mapped to `./shared`)
 - `N8N_BLOCK_ENV_ACCESS_IN_NODE=false` allows Code nodes to access environment variables
 

README.md

@@ -208,9 +208,9 @@ See the Cloudflare Tunnel guide: [cloudflare-instructions.md](cloudflare-instruc
 
 ### Using Libraries in n8n Code Nodes (v2.0+)
 
-n8n v2.0 uses external task runners to execute JavaScript and Python code in Code nodes. This setup pre-configures the following libraries:
+n8n v2.0 uses external task runners to execute JavaScript and Python code in Code nodes. This setup pre-configures the following libraries via `n8n/Dockerfile.runner` and `n8n/n8n-task-runners.json`:
 
-**JavaScript libraries** (via `NODE_FUNCTION_ALLOW_EXTERNAL`):
+**JavaScript libraries**:
 - **`cheerio`**: For parsing and manipulating HTML/XML (e.g., web scraping).
 - **`axios`**: A promise-based HTTP client for making requests to external APIs.
 - **`moment`**: For parsing, validating, manipulating, and displaying dates/times.

docker-compose.yml

@@ -121,12 +121,8 @@ x-n8n-worker-runner: &service-n8n-worker-runner
   environment:
     N8N_RUNNERS_AUTH_TOKEN: ${N8N_RUNNERS_AUTH_TOKEN}
     N8N_RUNNERS_AUTO_SHUTDOWN_TIMEOUT: 15
-    N8N_RUNNERS_EXTERNAL_ALLOW: "*"
     N8N_RUNNERS_MAX_CONCURRENCY: ${N8N_RUNNERS_MAX_CONCURRENCY:-5}
-    N8N_RUNNERS_STDLIB_ALLOW: "*"
     N8N_RUNNERS_TASK_BROKER_URI: http://127.0.0.1:5679
-    NODE_FUNCTION_ALLOW_BUILTIN: "*"
-    NODE_FUNCTION_ALLOW_EXTERNAL: cheerio,axios,moment,lodash
 
 services:
   flowise:

n8n/Dockerfile.runner

@@ -4,7 +4,11 @@ FROM n8nio/runners:${N8N_VERSION}
 USER root
 
 # Install npm packages that can be used in Code nodes
-# These must match NODE_FUNCTION_ALLOW_EXTERNAL in docker-compose.yml
-RUN npm install -g cheerio axios moment lodash
+# These must match NODE_FUNCTION_ALLOW_EXTERNAL in n8n-task-runners.json
+# Note: n8nio/runners uses pnpm, not npm
+RUN pnpm add cheerio axios moment lodash
+
+# Copy task runner configuration
+COPY n8n-task-runners.json /etc/n8n-task-runners.json
 
 USER node

n8n/n8n-task-runners.json

@@ -0,0 +1,10 @@
+{
+  "task-runners": {
+    "js": {
+      "env-overrides": {
+        "NODE_FUNCTION_ALLOW_EXTERNAL": "cheerio,axios,moment,lodash",
+        "NODE_FUNCTION_ALLOW_BUILTIN": "*"
+      }
+    }
+  }
+}