Docker containers probably aren’t enough isolation. But throw some firecrackervm in the pot and you’ve got a stew going.

Repl.it uses Docker containers too, only recently started work on moving to better isolation mechanisms like VMs

At replit every repl is indeed a docker container, but that is absolutely not the primarily isolation mechanism. Here’s a comment from CEO @amasad to that effect in 2019 (so, even more secure now I am certain) https://news.ycombinator.com/item?id=19215175

I'm using https://github.com/live-codes/livecodes to just move it all completely into the client with a replit-like alternative thing we're working on

This would be interesting to me. There are a few options now, like Judge0, but the language versions are pretty out of date. Self-hosting is not a good time investment at the moment.

Email me at hn at vikas.sh if you have a service. I'd need an SLA for sure, and multi-file support would be nice to have.

We serve production code execution use cases (mainly Python) with Jamsocket: https://jamsocket.com/

We've been running it for over a year and would be willing to talk about an SLA. Each instance gets its own gvisor-sandboxed runtime and we do some network isolation on top of that. (We also have some crypto miner mitigation, because if you provide free compute to strangers they will manage to find you.)

> I'm curious if anyone would like to use the code-execution as a service.

I am sure there are many whom would. Some may use it ethically, but many will not.

All will place liability on the service.

I built this with AWS Lambda. Relevant info if someone else wanted to try my approach to build such a service: https://mattslifebytes.com/2023/04/14/from-rebuilds-to-reloa...

> In case of REPL, you send STDIN to websocket and get STDOUT as response.

I wonder if repl.it ever did this, or if they've always used WebAssembly? (They definitely use wasm now.)

Nope, every repl is running in a docker container on a GCP vm, with various other security measures. See: https://news.ycombinator.com/item?id=19215175

I believe the very first version of replit was all in-browser, but no longer

> Nope, every repl is running in a docker container on a GCP vm, with various other security measures.

Wow, that's a change. I remember using replit with Python compiled to wasm. It was neat for a few seconds.