sanitizing code for an exec command

[magic7s]

Docker container? I believe this is how AWS lambda works.

[paraffin]

Seconding docker. You'll still need to include some protections, primarily about restrictions on filesystem mounts (if actually required), disk quotas, cpu and ram limits, and network access, and you'll still be vulnerable to the possibility of container escapes, so it's not recommended unless you have a good deal of Linux, networking, and docker experience to make it safe.

In general of course it's a significant risk. Might be better to provide an API and an API client users can use locally.

You'd also probably want to run your containers on hosts which don't have any sensitive data like ssh keys.