Add Python runtime support

[N3xusFour]

Summary

Add Python as a supported runtime to unlock AI/ML and data processing use cases.

Motivation

• Python is the dominant language for AI/ML, data science, and scripting
• LLMs frequently generate Python code for data processing tasks
• Unlocks libraries like numpy, pandas, requests, etc.

Implementation Plan

1. Extend Dependencies model

Add Python dependencies field in models/models.go:

type Dependencies struct {
    NPM    []string `json:"npm,omitempty"`
    Deno   []string `json:"deno,omitempty"`
    Python []string `json:"python,omitempty"`  // e.g., ["numpy==1.26.0"]
}

2. Extend Runtime enum

const (
    RuntimeDeno   Runtime = "deno"
    RuntimeBun    Runtime = "bun"
    RuntimeNode   Runtime = "node"
    RuntimePython Runtime = "python"
)

3. Create Python Dockerfile (services/runtime-python/Dockerfile)

FROM python:3.12-alpine

RUN addgroup -g 1000 pyuser && \
    adduser -D -u 1000 -G pyuser pyuser

USER pyuser
WORKDIR /workspace

COPY --chown=pyuser:pyuser runner.py /runtime/runner.py

ENTRYPOINT ["python", "/runtime/runner.py"]

4. Create Python runner (services/runtime-python/runner.py)

• Read stdin JSON
• Set os.environ from event.env
• Load user module via importlib.util
• Support both sync and async handlers (asyncio.run wrapper)
• Capture print() and logging output
• Output ExecutionOutput JSON to stdout

5. Add dependency installation

• Add installPythonDependencies() in executor/docker.go
• Use pip install --target /workspace/.site-packages or venv approach
• Prepend to sys.path in runner

Considerations

• Image size: Start with python:3.12-alpine for minimal footprint
• Native extensions: Some packages (numpy, pandas) need glibc; may need separate python-ml image later
• gVisor compatibility: Most Python code works fine; some C extensions may hit edge cases

Effort Estimate

~1-3 days

Acceptance Criteria

• runtime: "python" accepted in setup request
• Python handler functions execute correctly
• Both sync and async handlers supported
• pip dependencies install and are importable
• print() and logging output captured
• Works with gVisor sandboxing