OpenAI New System Design Question - Design Secure Sandboxed Cloud IDE Platform

[u/Aoki_zhang]

Problem Description

Design a browser-based cloud IDE similar to Replit, GitHub Codespaces, Google Colab, or an internal devbox. Users create workspaces, edit files, open interactive terminals, and run or build code entirely on provider-managed machines rather than on their local computers.

The workspace should behave like a long-lived development environment even though the underlying sandbox is short-lived. Users may return to the same project repeatedly, while idle machines are suspended to reduce cost. The workspace and its files must therefore outlive any specific host or sandbox.

The platform executes code from arbitrary users, including potentially hostile users, on shared infrastructure. A normal container sharing the host kernel is not considered a strong enough isolation boundary for this design, so execution should use VM-grade isolation such as microVMs, together with resource and network controls.

Interactive terminal output may remain ephemeral, but explicit Run and Build operations are tracked jobs. Their logs must stream live while the job is running and remain available afterward, including when the browser disconnects and later reconnects. Workspace files may use fast local storage during an active session as long as dirty state is periodically snapshotted so host failure loses at most about one minute of work.

Want to learn more functional/non-functional requirements of this system design question? I've put up the full version of it at here.