Overview
I built SAM Compiler to explore the complexities of secure, distributed code execution. The system handles untrusted multi-language code by orchestrating Docker-sandboxed environments, ensuring isolation with memory and CPU limits while providing a terminal-native developer experience.
The problem
Running untrusted code for many users at once is dangerous. Most setups trade latency for isolation, or collaboration for simplicity. The goal was strong isolation without losing a realtime, multi-user editing experience.
- Code injection
- Untrusted input executed with high privileges.
- Resource starvation
- Infinite loops or memory leaks taking down the engine.
- Sync drift
- State inconsistencies between collaborators editing the same file.
The approach
Every execution request is decoupled from the API, queued through BullMQ, and dispatched to a pool of ephemeral Docker workers that exist only for the duration of the task.
- CRDT-based sync
- Yjs-style CRDTs keep every collaborator consistent without a central lock, so edits never conflict.
- BullMQ worker pool
- A Redis-backed queue allows horizontal worker scaling, dead-letter handling and prioritized jobs.
- Ephemeral sandboxes
- Each run gets a fresh container with strict CPU and memory limits, so abuse never reaches the control plane.
- Fault isolation
- A failed container doesn't affect the IDE session; the orchestrator retries failed executions.
Architecture
- Frontend
- Gateway API
- Execution Workers
- Docker Sandboxes
- CRDT Synchronization
- Isolated Execution
- Queue Orchestration
Features
- Secure Docker sandbox execution
- Realtime collaborative editing using CRDTs
- Distributed worker architecture
- Multi-language code execution
- Queue-based orchestration
- Terminal-native experience
Challenges
- Prevented arbitrary code execution risks
- Built conflict-free collaborative editing
- Designed scalable execution architecture
Stack
- React
- TypeScript
- Node.js
- Docker
- Socket.IO
- BullMQ
- Redis
Demonstrates
- Distributed Systems
- Security Engineering
- DevTools Architecture
- Realtime Infrastructure