This. Awesome service, but pleasefortheloveofgod don't let people run arbitrary code inside Docker, unless you don't mind them getting out into the parent OS and messing around. You want VMs for that. (Yeah, that's much more resource intensive. Safely running arbitrary code is hard.)
seccomp provides a really good jail, probably all that's needed here.