A place where this is relevant that hasn't been mentioned so far is in proxies using the ProxyWASM spec. Instead of loading random libraries into the main code

A place where this is relevant that hasn't been mentioned so far is in proxies using the ProxyWASM spec. Instead of loading random libraries into the main code of say, Envoy, you instead load it as a WASM module (so you must target WASI or wasm32-unknown) and all you're allowed to do is specify a set of pre-determined entry points for when traffic connects, sends headers, sends body, and on the return path responds with headers, then body and then disconnects. This means that you can do practically all the things you need to do in a pretty portable way, without breaking into the actual program.