WASM just moves vulnerabilities to the wrapping code. If you use FS, then you still have to prevent the wrapper from stealing your /etc/passwd, so container it is