Cratera
Self-hosted Rust engine that runs untrusted code in Firecracker microVMs.
Cratera is a self-hosted code execution engine and judge written in Rust. It runs untrusted programs in short-lived Firecracker microVMs on Linux KVM.
Running code from strangers is risky. Containers share the host kernel, so one kernel escape can reach the host. Cratera gives every run its own guest kernel instead, which makes the KVM boundary the main layer of isolation.
A coordinator built on Axum listens on loopback, checks a bearer token and manages worker slots. Firecracker runs under its Jailer with dropped privileges, a chroot, seccomp, and cgroups v2 limits on memory, CPU and processes. Inside the guest, a small agent runs as PID 1, mounts a 256 MiB tmpfs in RAM and talks to the host only over a virtual socket. MicroVMs start with no network device at all.
Runs restore from a memory snapshot instead of booting Linux, in about 5 ms. Each job returns a verdict such as accepted, wrong answer or time limit exceeded, with compile time, wall time and memory used. In production mode it refuses to start with the Jailer off, a public bind address, or kernel and rootfs checksums that do not match.
It supports 30 toolchains, including Rust, Python, C++, Go and Java, all defined in one languages.toml file. It powers Cratery. Licensed Apache-2.0.
Docs are at cratera.org and code is on GitHub.