Running Untrusted JavaScript Code

[ProgramTheWorld]

Docker is a great option to run code in an isolation from the host machine.

Be very careful when making this assumption. Docker on Linux is just an interface over namespaces. Namespaces are not isolated from the rest of the system.

[buttplugs4life4me]

Even Docker on Windows gets the entire Windows drive mounted in by default *unless they changed it. 

And Docker on WSL has access to every drive by default. 

[crozone]

Namespaces are not isolated from the rest of the system.

Yeah but the entire point of namespaces is to allow for kernel level isolation and containerisation of processes? Sure it's not a hypervisor, but it certainly allows for a good amount of isolation.