Say you have to run untrusted code inside a Node service, like a user's script or a plugin. How do you isolate it?

So Node has a vm module that runs code in a separate context, and people sometimes use it to sandbox untrusted code. But the vm module isn't a real security boundary. The Node docs actually say straight up not to use it for untrusted code, because there are known ways to escape the context and reach the host. Genuinely untrusted code needs stronger isolation than that. You'd run it in a separate process with limited privileges, or in a container, or in a dedicated sandbox, something like a microVM or a WebAssembly runtime. You limit what the code can touch, so the filesystem, the network, the environment, and you set resource limits so it can't exhaust CPU or memory. Node also has a permission model now that can restrict filesystem and network access. The safe move is basically to assume the code is hostile and isolate it at the operating system level instead of inside the same Node process.