If you execute other people's code, at some point you have to decide what it is allowed to reach. Mine should reach nothing: no package registry, no pastebin, no callback to a server that tells it the answer. It should see its own filesystem, its own loopback interface, and the end of the world in every other direction. The usual answers are all heavy. Run your own Kubernetes with a deny-all NetworkPolicy and now you operate a cluster. Use Firecracker directly and now you operate a fleet. Bot...