That's fair, capabilities wise we have to limit certain things on what gvisor based sandboxes can do in terms of things like networking, and other capabilities to compensate for this class if sandbox. However over 80% of the use cases I'm seeing simply doesn't need much beyond that.