A detailed walkthrough of the system design behind Katabench, a .NET coding platform that safely executes arbitrary C# code submitted by users. The architecture uses three Hetzner VPS servers: one for the .NET API and Postgres, one for isolated code execution sandboxes, and one for deployment and observability. All servers are connected via a self-hosted Headscale/WireGuard VPN with no public exposure beyond ports 80/443. Code submissions flow through NATS JetStream to a worker that spins up throwaway containers with no network access and strict resource limits. The observability stack uses Grafana, Loki, Tempo, and Prometheus fed by OpenTelemetry collectors. Auth is delegated to Clerk and payments to Paddle (as merchant of record), while everything else is self-hosted on a fixed monthly cost.
Table of contents
The Big PicturePrivate by DefaultThe API Server and Everything It Leans OnThe Worker and the SandboxThe Platform ServerWhere I Buy Instead of Self-HostSummary193.5K Impressions6 Comments