requests.get() directly so a job can’t point your worker at a private address (such as the 169.254.169.254 cloud metadata endpoint).
download_files_from_urls
Use download_files_from_urls() when the job input contains one or more URLs and you want them all fetched into the job’s working directory in parallel. Files land in jobs/<job_id>/downloaded_files/ and the function returns the list of absolute paths.
None.
file
Use file() when the job input carries a single URL and you want the file name, extension, and (for zip archives) an auto-extracted directory. It saves the file under job_files/ and returns a dict:
file() streams the response to disk in chunks rather than buffering the body in memory, and calls raise_for_status() on the response. A 4xx or 5xx status raises requests.RequestException instead of writing the error body as the downloaded file, so callers must handle request exceptions.
SSRF protection
Both helpers route through an SSRF-safe fetcher that:- Allows only
httpandhttpsURLs. - Resolves the hostname up front and rejects any address that isn’t globally routable. This includes loopback, link-local (including
169.254.169.254), RFC 1918 private ranges, CGNAT (100.64.0.0/10), multicast, reserved, and the IPv6 equivalents (ULA, link-local, IPv4-mapped forms of the above). - Pins the TCP connection to the pre-validated IP so a DNS response can’t rebind mid-request.
- Disables automatic redirects and re-runs every check on each hop.
- Refuses URLs that would be fetched through an HTTP proxy, because pinning only holds when the SDK opens the socket itself.
NO_PROXYexclusions are honored. - Caps the total bytes written to disk and aborts the download if the cap is exceeded.
SSRFError (a subclass of ValueError). SSRFError is deliberately not a requests.RequestException, so it bypasses the download retry loop and surfaces immediately.
Configuration
Two environment variables tune the download helpers. Set them in the endpoint’s environment variables or in your Dockerfile.Allow private URLs
Downloading from a private address now requires opting in explicitly. SetRUNPOD_ALLOW_PRIVATE_DOWNLOAD_URLS=true only when your worker legitimately needs to fetch from a same-VPC host, a self-hosted object store on a private network, or another endpoint the platform routes internally. Leaving the guard in place is strongly recommended for any endpoint that processes URLs supplied by callers.
Change the size cap
OverrideRUNPOD_MAX_DOWNLOAD_BYTES to lower the cap for endpoints that only handle small inputs, or to raise it for a worker that ingests larger model weights. The value is in bytes:
Dockerfile