[gluczywo]

This was my first thought: sandboxing is gonna be tricky for such project.

[minxomat]

Not really, with SELinux, which is what TIO uses. TIO can be deployed pretty much anywhere SEL is supported. Instructions here: https://github.com/TryItOnline/tiosetup