Thanks for the suggestion. Thread is too deep to reply to your actual message, but I will look around to see how other "online judge" software run arbitrary code securely.

There's probably some low hanging fruit in configuring Docker properly.