How to validate user's uploaded codes automatically before executing on server

This is a very complex topic and it would need more details about what you're trying to achieve.

My first recommendation is that if you can avoid accepting custom code, go for it!

However, if you cannot avoid it then, under no circumstances run it on the same process/machines/network as your main service. Always assume that outside code is malicious.

You must run it in some sandbox. Something that I've done before and it was decently successful, was to it in something like AWS Lambda/Azure Functions, in an isolated network and only let it access the service through the public API. The custom code then becomes just another client that you host and it has to go through the regular authN/Z flow.

The big issues that you'll have to deal with:

1. If the custom code is not malicious but it's buggy, how will the creator debug it?
2. You need to prevent the custom code from accessing secrets or other's data
3. You can run into noisy neighbor problems (some custom code taking lots of resources and impacting everyone else)
4. Running someone else's code could be expensive. You need lots of rate limiting knobs and controls

In conclusion, if you can avoid custom code please consider it first! Even a DSL might be better...

PS: Indie Hackers is great but I recommend StackOverflow for such deep, technical questions