I suppose the question is why do the compilation server side? With a Linux sandbox policy as restrictive as WASI is, like by blocking all but a handful of sysca

I suppose the question is why do the compilation server side? With a Linux sandbox policy as restrictive as WASI is, like by blocking all but a handful of syscalls, is there much difference between native machine code and WASM from the cloud operator perspective? Is maybe the issue here that low level Linux sandboxing with bpf and stuff isn't well documented, or maybe not trusted?