I thought you could safely sandbox code via an iframe, though I'm not certain. Of course using your own interpreter might allow for more features, like tighter timeouts, custom APIs, etc.
I would like to know more about this too, especially when you add service workers into the mix.
I am currently using an iframe that accepts code with a window message and it can evaluate the input code and respond with a window message back, which works quite well, but I am unsure if there may be holes out of the sandbox
For more complicated things for example package dependencies I tried parsing them with Babel then producing an import map with cdns (esm.sh) but in some cases the cdnified versions don't work well
So I used stackblitz which kinda works well but has some issues in non secure contexts
So I ended up coding a little web server that takes in the code and dependencies (package.json) and does a vite build inside a docker container and sends the output back, it's working decently but can be slow sometimes
Doing a build completely on the client would be great, which is kinda what stackblitz does
