How will this JS execution be contained/isolated? Do we have to run it inside a VM, or containers?
They are running the JS in Deno, a sandboxed JS runtime.