This feels like shifting the trust boundary from the OS (containers) into your runtime (WASIX + shims).

Curious how this holds up under hostile workloads, especially with native modules and libuv in the mix.