experimental confined-code execution environment