Working on a service in Go that does this, focusing on no fuzz embeds, yet to be launched tho and the source is not released yet either but it will be. Anyway,

Working on a service in Go that does this, focusing on no fuzz embeds, yet to be launched tho and the source is not released yet either but it will be. Anyway, it's currently docker based, basically the only interesting thing is the run endpoint which is a POST request that copies the payload files to a tmpdir on disk (cached files are just represented as a path). With the files available I spin up the language appropriate container with the tmpdir mounted as the working directory and the default run command (which can be overriden to specify other build options etc but there's a reasonable default built into every docker image). The output is streamed as plain-text so it works reasonably well even with no JavaScript but SSE is used when JavaScript is enabled, look a bit prettier. WebSockets are just not implemented yet. Finally, I found it annoying not being able to preview servers etc on other playgrounds so TCP connections are proxied, each time a subdomain is accessed it looks up the port and maps it accordingly to the container. There's a bit of overhead to all this tho, from hitting the run button until seeing output can take anywhere from 10 to 60 seconds. As for safe execution, people have broken out of docker containers before and no doubt people will do it in the future. Best you can do is minimize the damage breaking out of the container would be able to do by isolating the machines that run the containers from the rest of the stack.