WSL2 is also a VM. docker relies on the linux kernel apis, so it must be ran inside a linux VM on macos or windows

Windows does have a native sandboxing API that Docker is capable of using IIRC, but nobody uses it.

The macOS situation is even worse in that the kernel lacks the requisite capabilities.