We're running users' arbitrary code wrapped in Docker. This allows us to isolate the code from our infrastructure and keeps all of us happy and worry free. CPU, memory and networking can be assigned directly in the docker run command. That's good for us. But sometimes the user code ends up in…