1. A method of operating an application server in a system having a plurality of application servers, each application server comprising memory and one or more processors, the method comprising: storing a plurality of applications in memory; receiving a request from a client to execute a respective application of the plurality of applications; executing an instance of the respective application; determining whether execution of the instance of the respective application violates any of a plurality of execution restrictions, the plurality of execution restrictions selected from the group consisting of: a response time limit; an average response time limit over multiple executions of the respective application; a volatile memory usage limit that limits how much volatile memory can be used by each execution of the respective application; a restriction on using non-volatile storage of the application server; and a requirement that any state information to be retained after returning the result is either sent to the client for storage, or retained in a datastore accessible by all the application servers in the plurality of application servers; when execution of the instance of the respective application does not violate any of the plurality of execution restrictions, returning a result to the client; and when execution of the instance of the respective application does violate one or more of the plurality of execution restrictions, terminating execution of the instance of the respective application without returning a result to the client.