IIRC the main sandboxing comes from a wrapper around libc that restricts pathnames used in open() and friends. It seems reasonably well designed for its intent but probably not super difficult to escape. Certainly if the C library adds another entry point, it won't be obvious that there's a new way around.

What the Compiler Explorer has going for it in this regard is that there's very little treasure to be found once you escape. No user accounts, no passwords, no security questions, no financial transactions, etc.

Compiler Explorer doesn't execute the programs it builds, so the risk is limited to what you can convince the compiler/assembler to do on your behalf.

Works for me, you just gotta pass -E in the args. Also need to spell include right.

Exactly :) Also even if it could, it would be the `/etc/shadow` of the docker container things run in :)