That's fun:) The one thing that would have made me hesitate is getting the attacker to go after hand-rolled Python; I would personally not trust my python against an attacker. On the other hand, it wad isolated so probably not a big deal even if the attacker managed to exploit it; exploiting a dummy app on an isolated server isn't terrible:)