Atvinta developers implemented a secure code execution sandbox for an educational platform to support Python programming tasks. The team initially considered Docker but found it inefficient due to slow container startup times and synchronous execution, which caused delays during high traffic.
The team adopted Piston, an open-source execution engine. Piston uses Linux containers (LXC) and runs tasks under 150 non-privileged users. It enforces strict resource limits, including a maximum of 64 processes and 2048 open files, and mounts the file system as read-only to prevent malicious code execution.
To ensure independence from external providers, the team hosts all Piston container layers in their own registry. They restricted the engine to Python by modifying the package repository URL and adjusted the JSON body parser in index.js to support larger file uploads for assignments.
The backend integration uses a Bridge class to manage communication with the Piston API. Since the base image is lightweight, the system verifies the presence of the Python runtime via API calls before executing user code. A custom Python script overrides the import function to restrict library usage for educational purposes.
The platform includes a test-case feature that allows mentors to validate student code against various inputs. The service layer automatically swaps input data and files, executes the code, and compares the output against expected results, returning a success flag and detailed logs.
