Oh god. Just checked out this dbgr situation. Looks like they allow you to run arbitrary code inside one of their docker instances. DISASTER.

Never ever use docker for security. With a Linux kernel local root exploit (which are indeed plentiful), one can escape from a docker container into the initial namespaces of the system.

It doesn't even look like they bother keeping their kernel up to date either.

DISASTER!

I liked the approach I saw at a couple other sites -- compile an interpreter to JavaScript with emscripten, and have all the code execute client side.