Ask HN: How do you run your customers' apps?

I'm working on a tool that requires running my customers' APIs inside of self-contained environments. They can create/destroy these environments at any time. Is there a 'best practice' method for this situation? Some googling turned up very little (maybe I don't know the term for this type of thing), so I thought I'd raise the question here instead.

My gut instinct is to run each inside of its own Docker container, perhaps in a Kubernetes cluster. Is this safe?