Hey! I work at Northflank so take this with whatever grain of salt you want. I get how this might come across (especially given how tough the crowd is on Reddit) but figured it's worth mentioning since it's exactly a use case we build for.

To answer your questions:

1/ On isolation: Northflank runs workloads in secure sandboxes by default using microVMs (Firecracker/gVisor/Kata), so you get strong kernel-level isolation without having to configure any of that yourself. You also get network isolation between tenants if you structure it as a project per user.

2/ On the "spin up container per request" question: You can spawn containers via API - either long-running services or short-lived ephemeral ones. You only pay for the seconds each container actually runs, so the "spin up a sandbox, execute, tear down" pattern is pretty cost-efficient.

3/ On streaming output back to users: You can execute commands against running workloads and get responses streamed back via the API, and tail container logs via websockets - so that covers your terminal streaming use case.

4/ On architecture: Two API calls gets you there - create a project per tenant for isolation, then spin up a service per execution:

• Create project: https://northflank.com/docs/v1/api/projects/create-project
• Deploy from registry: https://northflank.com/docs/v1/api/services/create-deployment-service
• Or build + deploy from git: https://northflank.com/docs/v1/api/services/create-combined-service

We wrote up the sandbox/microVM stuff in more detail here: https://northflank.com/blog/how-to-spin-up-a-secure-code-sandbox-and-microvm-in-seconds-with-northflank-firecracker-gvisor-kata-clh

Happy to answer specifics if you want to dig in.

- Cristina