Ask HN: How Do Services Like PythonTutor and Repl.it Run Code Safely

I'm super curious to know how these services work under the hood. Are there any good writeups about safe execution of unknown code? Are they spinning up isolated VM's per user / connection?