gVisor and user-space kernelsgVisor is where the isolation model changes qualitatively. To understand the difference, it helps to look at the attack surface of a standard container.
The success of the test means project leaders are considering scrapping plans to flood 900 acres (364 hectares) of farmland in Gloucestershire, which was initially proposed to provide a compensating habitat for fish.。关于这个话题，旺商聊官方下载提供了深入分析
Update (Feb 27, 2026): Simon Willison pointed out that WASM support for interpreted languages is further along than I what I thought. wasm32-unknown-wasip1 is a Tier 2 supported target for CPython (meaning failures block releases), with unofficial WASI builds available. Pyodide ports CPython to WASM via Emscripten with support for packages like NumPy, pandas, and SciPy. On the JavaScript side, QuickJS compiled to WASM works well for sandboxed JS execution. Wasmer can run Python server-side on WASM including native modules like gevent and SQLAlchemy. I haven’t tried these yet, but I am looking forward to .，这一点在safew官方下载中也有详细论述
I should clarify that OCI is a distribution method - the deployed system won’t run in a container, we’re booting a real Linux.