Fair enough. I guess a more basic question than how you're preventing people from probing for nodejs packages they could misuse would be the more pedestrian pro

Fair enough. I guess a more basic question than how you're preventing people from probing for nodejs packages they could misuse would be the more pedestrian problem of how do you deal with runaway processes, especially if they end up blocking the event loop that should theoretically kill them. Mark/sweep from another process that restarts pm2 or whatever? The reason I'm curious is that a lot of my private projects rely on evaluating code server side, but it's a big reason I'm not willing to share them with the public, because the overhead of watching for abuse would just make it.. not worth it. It falls into the category of "this is why we can't have nice things". As a security challenge though (for the defender) I do love something like this. But I doubt dockerizing it would help against CPU abuse unless you want to spin up a docker vm for every request..