It mostly comes down to security vs performance. If you have a fully trusted workload, you may decide not to use sandboxing, since using solutions like gVisor o

It mostly comes down to security vs performance. If you have a fully trusted workload, you may decide not to use sandboxing, since using solutions like gVisor often leads to performance issues on unoptimized workloads. For most use cases runc is probably a better choice (and can be reasonably secured, of course not in the same way).