Lua has excellent support for building sandboxes for untrusted user code.

Interesting - but what do you mean 'building' sandboxes?

i'm not exactly sure what he's talking about, but there's 2 things Lua has here. one is that the language is functional, so you can replace, alter, or remove the dangerous functions. the other is that you can specify the variable 'environment' of a function with a table (Lua's hash.) so you can construct its environment in an 'opt-in' basis and know for sure everything you're allowing the function to do is safe. and of course these things would be meaningless if built-in functions didn't behave like user functions

Upmodded and done for Lua.

You can map down a few languages to JVM executable bytecode, can't you?

In what way does Java provide sandboxing of untrusted code?

Untrusted Java web start applications and Java applets can't do anything that could harm the real operating system. We had to buy and keep on renewing an expensive code-signing cert so our app could save a local file. Every once in a while, a security researcher claims to have gotten untrusted bytecode to run outside the boundaries of the sandbox.