We have a cluster of codechecker servers of the above type, which share the load of incoming queries. On each, sandboxing is via a chroot-based system. Programs get a fixed amount of memory/time.
Re: the codechecker keyfile - we're looking into this, as I'm not an android expert - but quick searching tells me this is used to sign apks. Our codechecker supports android builds, so that's probably what this is used for. This key is not used to sign anything official (like throwaway id_rsa you create when needed). Again, I'm not the expert on this and I'll add a confirmation here shortly.
That said, if anyone finds something a vulnerability/way out of the sandbox, please shoot me a mail (anil @ hackerrank) if you'd like to do a private disclosure.