mithunmd2010/problem-helper-piston

Piston-Compatible Code Runner

Minimal FastAPI service used by the Problem Helper API to execute user-submitted Python and JavaScript. Implements the subset of Piston's HTTP contract that the backend's _run_via_piston actually calls — POST /api/v2/execute and GET /api/v2/runtimes.

We do not run upstream Piston. Piston requires a privileged container and root cgroup access for its isolate sandbox; Hugging Face Spaces forbids both. Rather than ship a fake Piston that can't actually sandbox, this is a small purpose-built runner with the same wire format.

Security posture

• —Zero secrets. This Space is configured with no environment variables. Compromised user code has nothing to exfiltrate.
• —No sandbox. User code runs in the container as a non-root user (UID 1000) with a 10-second wall-clock timeout. There is no per-job filesystem isolation.
• —One-way traffic. Only the Problem Helper API (on Render) is expected to call this Space. The Space has no outbound dependencies and no callers other than that API.
• —Rate-limited upstream. The Render API rate-limits /run and /submit, capping abuse of this Space's compute.

Runtimes

Baked into the image:

• —Python 3.10 (Debian slim)
• —Node.js 18 (NodeSource)

Deployment

1. 1.Create a Hugging Face Space, SDK = Docker, visibility = public.
2. 2.Push the contents of this huggingface/ directory to the Space's git repo (Dockerfile, app.py, requirements.txt, README.md at the root).
3. 3.First boot takes ~1–2 minutes for the image build.
4. 4.The public URL will be https://<user>-<space-name>.hf.space. Set PISTON_URL=https://<...>/api/v2/execute on Render.