You want to execute code you did not write, such as an LLM’s output, without risking your machine or other users. Why a sandbox fits. Each sandbox is a KVM microVM with its own kernel, so a bad script can fill its own disk and nothing else. See Security.
1

Create one sandbox per task

Pick the smallest template that has what the code needs: python for scripts, node for JavaScript. Set a short timeout so a forgotten sandbox is killed for you.
2

Run, read, and clean up

run_untrusted.py
The with block kills the sandbox on exit.
3

Decide what it may reach

Sandboxes can reach the internet by default, minus private ranges and cloud metadata, which are always blocked. Turn egress off or allow only the hosts you name: Networking. Give API tokens through the credential vault so the code never sees them.
Next: Run code for exit codes and environment, Processes for streaming output.