Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Sichere ProgrammierungWhy Claude Code keeps writing shell commands that fail on your Mac(20.09.2026 um 21:06 Uhr)
Sichere Programmierungllms.txt v2: What the Spec Says, and What 137,000 Domains Show(20.09.2026 um 21:17 Uhr)
Sicherheitslücken (CVE)NiceTryGPT: Less pattern matching. More actual hacking.(20.09.2026 um 21:19 Uhr)
IT Security VideoActivities BoF (kde2026)(20.09.2026 um 00:00 Uhr)
IT Security Toolsirdoc-app(20.09.2026 um 20:33 Uhr)
Sichere ProgrammierungWhy Claude Code keeps writing shell commands that fail on your Mac(20.09.2026 um 21:06 Uhr)
Sichere Programmierungllms.txt v2: What the Spec Says, and What 137,000 Domains Show(20.09.2026 um 21:17 Uhr)
Sicherheitslücken (CVE)NiceTryGPT: Less pattern matching. More actual hacking.(20.09.2026 um 21:19 Uhr)
IT Security VideoActivities BoF (kde2026)(20.09.2026 um 00:00 Uhr)
IT Security Toolsirdoc-app(20.09.2026 um 20:33 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

How we parse Apache Airflow DAGs without importing Airflow

Reagiere als Erste:r — dein Feedback zählt!

TL;DR — Leoflow runs a Go control plane that never imports Apache Airflow,
yet compiles standard airflow.sdk DAGs. It does it with a structural shim: a
pure-stdlib stand-in for airflow that the parser puts on the import path, then
execs your dag.py to record the graph (without running task bodies or
installing a single provider). Arbitrary provider operators are captured by
class + kwargs
at compile time and run for real in the task pod at runtime.
This is the engineering behind Leoflow v0.1.0.

The constraint that forces the design

Leoflow's scheduler is Go — no GIL, no Python in the hot path (that's the whole
point: Airflow's Python control plane is what makes it slow). But a Leoflow DAG is a
standard Apache Airflow 3.2 DAG, written against airflow.sdk:

from airflow.sdk import DAG, task
from airflow.providers.standard.operators.bash import BashOperator

with DAG("etl", schedule="@daily"):
    pull = BashOperator(task_id="pull", bash_command="echo '[1,2,3]' > /tmp/raw.json")

    @task
    def transform() -> int:
        import json
        return len(json.load(open("/tmp/raw.json")))

    pull >> transform()

So: how does a control plane that never imports Airflow read a DAG written against
the Airflow SDK?
Importing real Airflow into the parser would drag in the GIL, the
dependency tree, and parse-time side effects — exactly what we're escaping. The
answer (ADR 0024) is to not import Airflow at all.

The shim: a structural stand-in for airflow

The parser ships a pure-standard-library package that looks like airflow
same import paths, same attribute surface the compiler reads — and nothing else.
It's put ahead of any real Airflow on the import path, and then the parser simply
exec's your dag.py:

import runpy
runpy.run_path("dag.py", run_name="__leoflow_dag__")  # `airflow` resolves to the shim

Running the file builds structure. Here's the core of the shim (paraphrased):

_CURRENT: list = []     # stack of DAGs being defined
COLLECTED: dict = {}    # dag_id -> DAG, filled as each DAG context is entered

class DAG:
    def __init__(self, dag_id, schedule=None, tags=None, **kw):
        self.dag_id, self.schedule, self.task_dict = dag_id, schedule, {}
        COLLECTED[dag_id] = self
    def __enter__(self):  _CURRENT.append(self); return self
    def __exit__(self, *e): _CURRENT.pop()

class BaseOperator:
    def __init__(self, task_id, **kwargs):
        self.upstream_task_ids, self.downstream_task_ids = set(), set()
        # attach to the active DAG and store every kwarg as an attribute
        dag = kwargs.get("dag") or (_CURRENT[-1] if _CURRENT else None)
        if dag: dag.task_dict[task_id] = self
    def __rshift__(self, other):    # a >> b records the edge
        self.downstream_task_ids.add(other.task_id)
        other.upstream_task_ids.add(self.task_id)
        return other

The shim flow — dag.py is exec'd under a structural stand-in for airflow; DAG/operators register into COLLECTED, which the compiler turns into dag.json

with DAG(...) registers; constructing an operator attaches it to the active DAG and
stores its kwargs; >> records edges; @task builds the node but never runs the
body
. The compiler then reads COLLECTED and emits an immutable dag.json.

Two properties fall straight out of this:

  • Unsupported constructs can't be faked. A from airflow.<thing> the shim doesn't model raises ModuleNotFoundError, which the loader turns into a clear "not supported by Leoflow" error — at compile time, never a silent half-run.
  • Parsing has no side effects. @task bodies never execute during parsing, so a DAG file can't trigger its own work just by being read — the thing that makes Airflow's dag-parsing both slow and risky.

The control plane now has the graph without importing Airflow or installing one
provider
.

The long tail: capture, don't reimplement

Modeling all 1,500+ provider operators in the shim would be a treadmill. So for
anything beyond the native handful (bash, python, http, empty), the shim has a
meta-path finder (ADR 0040) that synthesizes any
airflow.providers.<x>.{operators,sensors,transfers}.<Class> on demand. It doesn't
implement the operator — it captures it: records the operator's real dotted
class path
and its constructor kwargs, then registers it like any node:

# in the dag.py — a provider operator the shim has never heard of
from airflow.providers.common.sql.operators.sql import SQLExecuteQueryOperator
SQLExecuteQueryOperator(task_id="rollup", conn_id="warehouse", sql="insert into ...")
# captured as: { class: "airflow.providers.common.sql.operators.sql.SQLExecuteQueryOperator",
#                kwargs: { conn_id: "warehouse", sql: "insert into ..." } }

No provider is installed in the parser. The dotted path and kwargs are just data in
dag.json.

The seam: the real operator runs in the pod

At runtime, inside the task's own pod — where the provider is installed, baked into
that DAG's image — the agent reconstructs and runs the genuine operator:

import_string(dotted_class)(**captured_kwargs).execute(context)

The real Airflow operator executes, with the real provider, against the real
connection — while the control plane that scheduled it never imported either.

Compile time: structure, dependency-free, in Go's world. Run time: the real Airflow
operator, in an isolated pod.
That split is the entire design — it's how you get
Airflow's ecosystem fidelity without Airflow's control plane.

Why it matters

  • No GIL, no Airflow imports in scheduling — the control plane stays fast and Go-native.
  • No dependency hell — each DAG owns its image; the parser needs zero providers.
  • No parse-time surprises — reading a DAG can't run it.
  • Full operator fidelity — the actual provider operator runs in the pod.

It's all open source (Apache 2.0): github.com/neochaotic/leoflow.
ADR 0024 (the shim) and ADR 0040 (operator capture) have the gory details.

Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten How we parse Apache Airflow DAGs without importing Airflow

Thematisch verwandte Begriffe: parse, Apache, Airflow, DAGs · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-93956 | A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by thi…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick