Sandboxing like gvisor is based on syscalls and iouring makes your code syscallless