Very neat indeed.
It says on the about page that it starts a container on demand and gives you the output.
You can see in the output that systemd detects it is running under podman.
No idea what kind of container as a service they are using, and how they secure/lock it down. Systemd is a pretty powerful system, you can make it execute pretty much anything...