I think many of them (esp. Hacker Rank) start up a container to run your program. Presumably these are configured to prevent access to the network, external files, etc.

The AWS Lambda console has a code editor/runner that looks a lot like what Hacker Rank has, but you are running on the real Lambda system which has some characteristics of VMs and containers.