One is microvms, the other is kernel-based. There are trade-offs between the two. One trade-off is that you have to put the data inside the sandbox if you are using a MicroVM. The other is that it is harder to contextually provide or change access to data in a microvvm sandbox. The final one is developer experience.

These techniques can actually be combined and will be combined in the long-term I think. You may have LSM-based sandboxes that exist in Docker-based sandboxes.