Not a silver bullet, but did you look into isolated-vm? https://github.com/laverdet/isolated-vm
But generally, I think best bet is to offload such things to e.g. Lambda per tenant.
The README says it's in maintenance mode and the single author doesn't have time to dedicate to the project.
The README says it's in maintenance mode and the single author doesn't have time to dedicate to the project.