cat /etc/passwd

  root:x:0:0:root:/root:/bin/bash
  bin:x:1:1:bin:/bin:/sbin/nologin
  daemon:x:2:2:daemon:/sbin:/sbin/nologin
  adm:x:3:4:adm:/var/adm:/sbin/nologin
  lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
  sync:x:5:0:sync:/sbin:/bin/sync
  shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
  halt:x:7:0:halt:/sbin:/sbin/halt
  mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
  operator:x:11:0:operator:/root:/sbin/nologin
  games:x:12:100:games:/usr/games:/sbin/nologin
  ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
  nobody:x:99:99:Nobody:/:/sbin/nologin
  systemd-timesync:x:999:998:systemd Time Synchronization:/:/sbin/nologin
  systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
  systemd-resolve:x:193:193:systemd Resolver:/:/sbin/nologin
  dbus:x:81:81:System message bus:/:/sbin/nologin
  polkitd:x:998:997:User for polkitd:/:/sbin/nologin
  rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
  abrt:x:173:173::/etc/abrt:/sbin/nologin
  sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
  cockpit-ws:x:997:995:User for cockpit-ws:/:/sbin/nologin
  rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
  nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
  tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
  chrony:x:996:994::/var/lib/chrony:/sbin/nologin
  tcpdump:x:72:72::/:/sbin/nologin
  systemd-coredump:x:993:993:systemd Core Dumper:/:/sbin/nologin
  apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin
  epmd:x:992:991:Erlang Port Mapper Daemon:/dev/null:/sbin/nologin
  runner:x:1000:1000::/home/runner:/bin/bash
  tio:x:1001:1001::/home/tio:/bin/bash
This was my first thought: sandboxing is gonna be tricky for such project.
Not really, with SELinux, which is what TIO uses. TIO can be deployed pretty much anywhere SEL is supported. Instructions here: https://github.com/TryItOnline/tiosetup