Sandboxing like gvisor is based on syscalls and iouring makes your code syscallless

Security reasons. https://news.ycombinator.com/item?id=44632240 There are also other edge cases around cgroups accounting that renders some isolation/throttling mechanisms not fully effective.