I'm building a project where my service would plug with the (unstrusted) JS code of users.

I first thought it would be easy to sandbox and have something decent running, but after making some research on sandboxing, I realize how hard it is, and the many ways bad actors can exploit a service running untrusted code.

Kudos to GitHub and GitLab for taking the challenge of providing a RCE service with a free plan.