What a sandboxed online compiler actually does

The editor UI (Monaco, themes, AST, share) runs in your browser. Execution happens elsewhere: Code Arena creates a short-lived sandbox, writes your file, runs a command, and returns stdout/stderr.

That split lets you use a comfortable IDE surface while keeping untrusted code away from other users and from your own machine. It is the same broad idea behind many cloud notebooks and CI runners, scaled down to a snippet.

Code Arena uses Vercel Sandboxes with limited CPU, a timeout, and a deny-all network policy. Your program cannot freely call the public internet or install packages mid-run.

After the run, the sandbox is stopped. There is no lasting machine for you to SSH into — it is a disposable runner for one snippet. That is a feature: leftover processes and files should not accumulate across strangers’ jobs.

Open execution environments are abused for scanning, spam, and crypto mining when outbound network is available. Denying network by default reduces that blast radius and makes the product’s purpose clearer: local-style logic, not a free proxy.

The tradeoff is real: demos that fetch APIs will fail. For those, use a local project, a purpose-built API client, or a runner that intentionally allows egress under auth.

Timeouts stop infinite loops. Rate limits slow abuse. Large sources may be rejected. These limits keep the service usable for everyone and keep hosting costs predictable.

When you hit a limit, shrink the problem. Fewer iterations, smaller strings, less logging noise. Playgrounds reward clarity more than stress-testing the VM.

• Prefer short scripts and clear console output
• Avoid mining, spam, or network-dependent demos
• Use a full local setup for real projects and dependencies
• Treat share links as public documents

Sandboxing protects the platform and other users; it does not make your secrets safe if you paste them into source or share URLs. Assume operators, logs, and anyone with a link might see what you submit.

Do not run Code Arena snippets as a place to store production credentials “just for a minute.” Minutes have a way of becoming screenshots and chat forwards.

A helpful classroom line: “The editor is yours; the computer that runs the code is borrowed and locked down.” That sets expectations about packages, files, and the internet in one sentence.

Then show a failing fetch or pip install on purpose. Seeing the limitation teaches architecture better than a paragraph in a syllabus.