Every generated app is its own computer

Your product lets users describe an app and ships the code an LLM writes. Nobody reviews it. At 300 apps a day, nobody could.

Each app runs in its own container, cloned from a base snapshot. The generated code has its own root filesystem, its own PID namespace, its own network namespace on its own bridge. When a prompt-injected app tries to read the neighbour's .env, there is no neighbour. When it opens a socket to somewhere odd, it hits the network exit you configured on the host before the first run, and the container can't modify that.

The worst case is one broken app. You delete the container, restore the user's last snapshot, and the other 299 keep running.

You can't review ten thousand lines an hour, so you give each ten thousand its own walls.