A method comprising: executing, by a cloud computer system, a plurality of template execution environments, wherein each of the plurality of template execution environments is configured to establish child execution environments, and wherein each of the plurality of template execution environments is configured to execute a different type of custom executable instruction; receiving, by the cloud computer system, from a mobile device (102, 104), a request to execute a custom executable instruction for a service provided by the cloud computer system to a tenant registered with the cloud computer system; determining, by the cloud computer system, one or more resources to support execution of the custom executable instruction for the service to be provided to the tenant; selecting, by the cloud computer system, a template execution environment from the plurality of template execution environments based on a type of service identified for the service and based on determining that the template execution environment is configured to provide the tenant with access to the one or more resources determined to support execution of the custom executable instruction for the service; loading, by the cloud computer system, the requested custom executable instruction for execution in a first child execution environment; configuring, by the cloud computer system, an access permission for the first child execution environment, wherein the access permission specifies one or more types of operations that are permitted or prohibited in the first child execution environment, and wherein the configuring comprises setting one or more settings of a callable interface so as to control accessing of services from the cloud computer system by the custom executable instruction, wherein the configured access permission prevents additional child environments being spawned by the custom executable instruction; after configuring the access permission for the first child execution environment, establishing, by the cloud computer system, the first child execution environment to execute the requested custom executable instruction, wherein the first child execution environment is established based on the template execution environment; and executing, by the cloud computer system, the requested custom executable instruction in the first child execution environment, wherein the requested custom executable instruction is executed after the access permission is configured. executing, by a cloud computer system, a plurality of template execution environments, wherein each of the plurality of template execution environments is configured to establish child execution environments, and wherein each of the plurality of template execution environments is configured to execute a different type of custom executable instruction; receiving, by the cloud computer system, from a mobile device (102, 104), a request to execute a custom executable instruction for a service provided by the cloud computer system to a tenant registered with the cloud computer system; determining, by the cloud computer system, one or more resources to support execution of the custom executable instruction for the service to be provided to the tenant; selecting, by the cloud computer system, a template execution environment from the plurality of template execution environments based on a type of service identified for the service and based on determining that the template execution environment is configured to provide the tenant with access to the one or more resources determined to support execution of the custom executable instruction for the service; loading, by the cloud computer system, the requested custom executable instruction for execution in a first child execution environment; configuring, by the cloud computer system, an access permission for the first child execution environment, wherein the access permission specifies one or more types of operations that are permitted or prohibited in the first child execution environment, and wherein the configuring comprises setting one or more settings of a callable interface so as to control accessing of services from the cloud computer system by the custom executable instruction, wherein the configured access permission prevents additional child environments being spawned by the custom executable instruction; after configuring the access permission for the first child execution environment, establishing, by the cloud computer system, the first child execution environment to execute the requested custom executable instruction, wherein the first child execution environment is established based on the template execution environment; and executing, by the cloud computer system, the requested custom executable instruction in the first child execution environment, wherein the requested custom executable instruction is executed after the access permission is configured.