A system (100, 200) comprising: a host computing system (110, 210, 600) comprising one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured so as to configure the host computing system to instantiate the following in response to the one or more processors executing the computer-executable instructions: a container (111, 211) configured to prevent access to data (117, 217) and resources (118, 218) on the host computing system except through one or more locations (113C, 114C, 213C, 214C) that are visible to the container; and a security component (112, 212) that is configured to do the following: facilitate input (113A, 213A) of input data (113B, 213B) to the container by: mapping a location within a data source as containing data that is pre-authorized for access within the container; checking whether code (115, 215) contained within the container is authorized to have access to the input data by checking that the input data is found within the mapped location; and if the code contained within the container is so authorized, providing the input data into one or more predetermined input locations (113C, 213C) visible to the container; and facilitate output (114A, 214A) of output data (114B, 214C) from the container by: reading the output data from one or more predetermined output locations (114C, 214C) visible to the container, and performing one or more security checks on the output data, and if the output data passes the one or more security checks, providing the output data external to the container, wherein performing one or more security checks comprises verifying that the data does not include an executable or instruction executable by the host computing system. a host computing system (110, 210, 600) comprising one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured so as to configure the host computing system to instantiate the following in response to the one or more processors executing the computer-executable instructions: a container (111, 211) configured to prevent access to data (117, 217) and resources (118, 218) on the host computing system except through one or more locations (113C, 114C, 213C, 214C) that are visible to the container; and a security component (112, 212) that is configured to do the following: facilitate input (113A, 213A) of input data (113B, 213B) to the container by: mapping a location within a data source as containing data that is pre-authorized for access within the container; checking whether code (115, 215) contained within the container is authorized to have access to the input data by checking that the input data is found within the mapped location; and if the code contained within the container is so authorized, providing the input data into one or more predetermined input locations (113C, 213C) visible to the container; and facilitate output (114A, 214A) of output data (114B, 214C) from the container by: reading the output data from one or more predetermined output locations (114C, 214C) visible to the container, and performing one or more security checks on the output data, and if the output data passes the one or more security checks, providing the output data external to the container, wherein performing one or more security checks comprises verifying that the data does not include an executable or instruction executable by the host computing system. facilitate input (113A, 213A) of input data (113B, 213B) to the container by: mapping a location within a data source as containing data that is pre-authorized for access within the container; checking whether code (115, 215) contained within the container is authorized to have access to the input data by checking that the input data is found within the mapped location; and if the code contained within the container is so authorized, providing the input data into one or more predetermined input locations (113C, 213C) visible to the container; and mapping a location within a data source as containing data that is pre-authorized for access within the container; checking whether code (115, 215) contained within the container is authorized to have access to the input data by checking that the input data is found within the mapped location; and if the code contained within the container is so authorized, providing the input data into one or more predetermined input locations (113C, 213C) visible to the container; and facilitate output (114A, 214A) of output data (114B, 214C) from the container by: reading the output data from one or more predetermined output locations (114C, 214C) visible to the container, and performing one or more security checks on the output data, and if the output data passes the one or more security checks, providing the output data external to the container, wherein performing one or more security checks comprises verifying that the data does not include an executable or instruction executable by the host computing system. reading the output data from one or more predetermined output locations (114C, 214C) visible to the container, and performing one or more security checks on the output data, and if the output data passes the one or more security checks, providing the output data external to the container, wherein performing one or more security checks comprises verifying that the data does not include an executable or instruction executable by the host computing system.