Software Sushi Visual Workflow App

1. Launch your instance

Require IMDSv2 and allow outbound access to the model provider you select. No model subscription, API key, weights or credits are included. First boot creates your administrator identity and starts the application automatically; initialization can take several minutes.

Keep port 7860 closed to inbound network traffic. Use an authenticated port-forwarding session. Session Manager requires an instance role and user permissions for Systems Manager, plus network access to its service endpoints. SSH requires your EC2 key pair and port 22 restricted to your administrative address.

2. Check status and retrieve your login

Open an instance shell through the EC2 console’s Session Manager connection. If the shell starts as ssm-user, switch to the customer account:

sudo -iu ubuntu
sushi-langflow help
sushi-langflow status
cat /etc/langflow/admin.json

For SSH, sign in as ubuntu. Read the username and unique password from admin.json in your private terminal. Keep that file and its values confidential. Public signup and automatic login are disabled.

If startup is still initializing, wait and recheck status. Inspect service logs from the instance with:

sudo journalctl -u langflow.service --no-pager -n 100

3. Open the editor through a tunnel

On your local computer, open a Bash shell (on macOS, enter bash first), configure the AWS CLI for the account containing your instance and install the Session Manager plugin. Enter the actual instance ID when prompted. This command is for an instance launched in us-east-1:

read -r -p "EC2 instance ID: " SUSHI_LF_INSTANCE_ID
aws --region us-east-1 ssm start-session \
  --target "$SUSHI_LF_INSTANCE_ID" \
  --document-name AWS-StartPortForwardingSession \
  --parameters '{"portNumber":["7860"],"localPortNumber":["7860"]}'

Keep this local command running. Open http://127.0.0.1:7860 in your local browser and sign in with the instance-generated credentials. The application itself listens only on 127.0.0.1:7860 inside the instance.

read -r -p "Absolute EC2 key-file path: " SUSHI_LF_SSH_KEY
read -r -p "Instance DNS name or address: " SUSHI_LF_EC2_HOST
ssh -i "$SUSHI_LF_SSH_KEY" -N \
  -L 7860:127.0.0.1:7860 "ubuntu@$SUSHI_LF_EC2_HOST"

Session Manager setup and port forwarding · Install the local plugin

4. Save and run a visual flow

Use a desktop browser for editing workflows. The visual canvas has limited space on a phone.

Connect ChatInput → OpenAI model → ChatOutput in the editor. Configure a model and an OpenAI-compatible endpoint available to your own provider account, supply your provider key, save the flow and run it in the playground. Each execution can incur provider charges.

The supplied model bundle is OpenAI-compatible. No model account or provider credits are bundled. Custom component uploads, component-path overrides and code interpreter components are disabled. SSRF protection is enabled. Private provider endpoints require an exact operator-managed hostname allowlist; the default allowlist is empty.

5. Run the installed command-line demo

In your instance shell as ubuntu, inspect the arguments:

sushi-langflow demo --help

Create a mode-0600 provider-key file without putting the key in shell history or command arguments. The following creates a new file and refuses to replace an existing one:

python3 - <<'PY'
import getpass
import os
from pathlib import Path
key = getpass.getpass("Provider API key: ").strip()
if not key or "\n" in key or "\r" in key:
    raise ValueError("Enter one nonempty key line")
path = Path.home() / ".langflow-provider-key"
fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
with os.fdopen(fd, "w") as stream:
    stream.write(key + "\n")
print("Protected key file created.")
PY

Enter your actual provider API base URL and enabled model ID, then run the demo. For OpenAI, the API base is https://api.openai.com/v1:

read -r -p "Provider API base URL: " SUSHI_LF_ENDPOINT
read -r -p "Provider model ID: " SUSHI_LF_MODEL
sushi-langflow demo \
  --endpoint "$SUSHI_LF_ENDPOINT" \
  --model "$SUSHI_LF_MODEL" \
  --api-key-file "$HOME/.langflow-provider-key"

The command logs in to the local application, saves a private three-node flow, executes a short prompt and independently rereads the saved response. It prints the flow ID, session ID and model response. Find the named Sushi visual flow in the editor to inspect its nodes and run it again. A provider failure does not produce a substitute answer.

Provider configuration can be saved with flows. Treat flow exports, application state, backups and the key file as confidential; inspect exports before sharing them.

6. Keep your state and identity together

This is a single-instance application with one worker and SQLite at /var/lib/langflow/langflow.db. State lives in /var/lib/langflow; configuration and administrator identity live in /etc/langflow.

Stop Langflow before a filesystem backup, or use a consistent SQLite backup or snapshot. Back up both directories together, including service.env, admin.json, initialized.json and any operator.env. Restore the database with its original encryption and administrator configuration. Generating a replacement key can make stored credentials unreadable. Existing identity is retained across restart; a missing initialized database fails visibly.

Operator settings belong in root-managed /etc/langflow/operator.env with mode 0600. Restart with sudo systemctl restart langflow.service after an approved configuration change. Software updates are delivered through replacement AMI releases; retain a consistent backup before migrating.

Costs and support

Software: USD 0.03 per running instance-hour. EC2 compute, EBS storage, data transfer and model-provider calls are billed separately. Starting a model run uses your provider account and may incur additional charges.

Software Sushi provides AMI packaging and setup guidance. For installation questions, contact info@softwaresushi.com. Support coverage requires a separate agreement; this offer does not include upstream project support.

On-instance documentation and notices

cat /opt/sushi/docs/README.md
cat /opt/sushi/docs/DEMO.md

Original sources are in /opt/langflow/sources; dependency notices and their index are in /usr/share/doc/langflow. Langflow is MIT-licensed; dependencies retain their own license terms.

Langflow upstream documentation. Upstream documentation may describe optional components that this image disables; use the settings documented in the installed guide for this image.