[godwhoa]

FWIW, most of the untrusted code execution "platforms" these days use Docker with some hardening (dropped capabilities, syscall filtering, readonly fs etc). Eg. Repl.it and Rust Playground.