In Lua its the host that does the actual allocs (lua_setallocf()), and its routine for the host to intercept those mallocs and do accounting. Now even with a '

In Lua its the host that does the actual allocs (lua_setallocf()), and its routine for the host to intercept those mallocs and do accounting. Now even with a 'locked down' Lua VM there is a lot of trust in executing 3rd-party scripts and there might be various attacks. But as I said, I really could imagine some next-gen CDN allowing paying customers to put Lua scripts in the edge to rewrite requests and responses. If I were tackling it I would want all the script instances for any given customer to be isolated at a hardware level from other customers too.