Nitro Contestant Runtime

The owned, reproducible runtime used by Nitro AI contestant notebooks and the submission proxy. This repository retains the history and AGPL-3.0 license of the original nitronlp/contestant-jupyter-server project.

Published interfaces

Python 3.11 applications can install the shared scientific/ML runtime or the same runtime plus the notebook UI:

pip install nitro-contestant-runtime==1.0.0
pip install "nitro-contestant-runtime[notebook]==1.0.0"

The package contains dependency metadata only; it intentionally installs no importable nitro_contestant_runtime module.

The matching Linux/AMD64 fallback containers are:

ghcr.io/mihneateodorstoica/nitro-contestant-notebook:1.0.0
ghcr.io/mihneateodorstoica/nitro-submission-proxy:1.0.0

1.0 and stable are promoted only after both exact images pass the shared runtime, proxy, Jupyter base-path, and cross-image cloudpickle checks.

Runtime contract

The notebook keeps the upstream /home/jovyan home, /opt/conda runtime, custom OAuth login, base-path entrypoint, and outbound network isolation. It accepts the base path as its first argument and exposes Jupyter on port 8888. Both PROXY_URL and NITRO_SUBMISSION_PROXY_URL point at the submission proxy; PROXY_URL_CLIENT is the browser-visible URL.

The proxy keeps the Python 3.11/nsjail prejudging sandbox, cache and API contract, and exposes /health and the proxy API on port 9000. Required proxy settings are JUDGE_BASE_URL, ORGANIZATION_SLUG, COMPETITION_SLUG, and JUPYTER_BASE_URL.

Local stack

docker network create nitro_net
mkdir -p secrets
touch secrets/session_whitelist_bypass_key
cp jupyter-server/.env.example jupyter-server/.env
cp submission-proxy/.env.remote submission-proxy/.env
docker compose up --build

Edit the organization, competition, judge, and Jupyter URLs in submission-proxy/.env before connecting to a real competition. Add docker-compose.gpu.yml when the NVIDIA Container Toolkit is available:

docker compose -f docker-compose.yml -f docker-compose.gpu.yml up --build

Reproducing the lock and images

pyproject.toml is the only hand-edited dependency input. uv.lock and the two hashed pip exports are tracked:

uv lock
uv export --locked --no-dev --no-emit-project --output-file requirements/base.txt
uv export --locked --no-dev --no-emit-project --extra notebook --output-file requirements/notebook.txt
docker build -f jupyter-server/Dockerfile -t nitro-contestant-notebook .
docker build -f submission-proxy/Dockerfile -t nitro-submission-proxy .

Both Dockerfiles use the repository root so the image installs those exact hashes and then installs the local metadata package with --no-deps.