Developing with environment isolation-Platform For AI(PAI)-阿里云帮助中心

To ensure the stability and security of the production environment, enterprises typically isolate their development, testing, pre-release, and production environments. LangStudio offers two solutions for environment isolation based on the Alibaba Cloud account system and PAI workspaces. It also supports using application configuration items to simplify deployment and configuration management across environments. This approach is especially useful for complex workflows with many nodes.

Choosing a solution

LangStudio provides two solutions for environment isolation: PAI workspace isolation and Alibaba Cloud account isolation. You can choose the most suitable solution based on your enterprise's security compliance requirements, management model, and cost considerations.

Aspect	PAI workspace isolation (single-account)	Alibaba Cloud account isolation (multi-account)
Isolation method	Logical isolation between multiple PAI workspaces within a single Alibaba Cloud account.	Complete resource and permission isolation across multiple Alibaba Cloud accounts.
Use cases	For enterprises that prefer managing multiple environments in a single account to reduce cross-account operational complexity.	For enterprise environments with stringent security and permission boundary requirements.
Advantages	Simplified account management Flexible application migration Centralized cost management	Complete resource and permission isolation for high security Simplified permission management for development and operations staff Meets enterprise security and compliance requirements
Prerequisites	Create multiple PAI workspaces in the same Alibaba Cloud account.	Create multiple Alibaba Cloud accounts, then activate the PAI service and create a PAI workspace in each account.

Recommended practices:

For most enterprises, consider the workspace isolation solution for its simple management and controllable costs.
For enterprises with strict security and compliance requirements, choose the account isolation solution to achieve complete resource and permission isolation.
Regardless of the chosen solution, we recommend using application configuration items to manage environment-specific configurations and reduce the complexity of migrating across environments.

Workflow

The workflow is largely the same for both solutions. The primary difference is whether operations span multiple accounts.

Prepare the environments:
- Workspace isolation: In a single Alibaba Cloud account, create separate PAI workspaces for your development, testing, pre-release, and production environments.
- Account isolation: Create a PAI workspace in each of your Alibaba Cloud accounts.
Development: In the development environment's PAI workspace, build, debug, and validate your application.
Export the application: Export the completed application.
Import to the target environment: Import the application into the PAI workspace of the target environment, such as the production environment.
Adjust the configuration: Update the application's resource configurations, such as LLM connections or knowledge bases, to match the resources in the target environment. For details on using application configuration items, see Using application configuration items to simplify cross-environment configuration.
Publish: After completing the configuration, publish the service in the target environment.

Simplify cross-environment configuration with application configuration items

When you migrate an application between environments, you often need to change its dependent resources, such as models, connections, and knowledge bases, regardless of the isolation solution used. To avoid hard-coding these configurations, use application configuration items to simplify cross-environment configuration. This practice lets you configure settings once, reference them anywhere, and switch between environments flexibly.

Workflow mode

To use application configuration items in workflow mode, follow these steps:

1. Create application configuration items

On the application development page, choose Settings > Application Configuration and create the required key-value pairs, such as an LLM connection name and a model name. Set the variable values to the actual resource names in your development environment.

For example, add the variable name connection_name with the value dashscope, and the variable name model_name with the value qwen3-max.

2. Reference configuration items in workflow nodes

Using an LLM node as an example:

In the node's Model settings, select Reference Variable.
In the Connection and Model drop-down lists, select the corresponding application configuration items.

3. Automatic runtime resolution

When the workflow runs, the system automatically reads values from the current application configuration and injects them into the node to call the appropriate resources.

4. Cross-environment migration

When you migrate the application to a new environment, such as a production environment, by using Export Workflow and then importing it, you only need to update the variable values in Settings > Application Configuration to match the new resources. This eliminates the need to modify each workflow node individually.

Code mode

In code mode, you typically manage environment dependencies by using a configuration file and inject sensitive information through environment variables as a security best practice.

1. Define an environment configuration file

In your project's root directory, create a config.yaml file (or a custom name) to centrally manage the resource identifiers and sensitive information required for the current environment.

# config.yaml example
llm:
  provider: dashscope
  model_name: qwen-max
  api_key: ${LLM_API_KEY}
knowledge_base:
  index_name: prod_kb_v2
  embedding_model: text-embedding-v2

Best practices:

Avoid hard-coding sensitive information, such as API keys or passwords, in the configuration file.
We recommend using the "${ENV_VAR}" format to reference environment variables. The actual value is injected by the target environment's security mechanisms at runtime.
You can maintain separate configuration files for different environments, such as config.dev.yaml and config.prod.yaml, and automatically load the appropriate file during your deployment process.

2. Load and use the configuration in code

Load the appropriate configuration file as needed, and then parse and use its parameters in your application's business logic.

3. Deploy across environments and switch configurations

When you migrate the application from a development environment to a production environment, you do not need to change your core business logic. Simply specify the configuration file for the target environment to run the application with the correct settings.