Safely compiling and executing arbitrary, untrusted user code under two-second time limits and strict memory caps. How an online judge isolates execution using gVisor and seccomp, differentiates CPU time from wall-clock time, prevents fork bombs with cgroups v2, and defends worker nodes from infinite output denial of service.