The documentation is lacking, but the important context is that you can run this through the Wasmer webassembly runtime, which provides complete isolation. It

The documentation is lacking, but the important context is that you can run this through the Wasmer webassembly runtime, which provides complete isolation. It would only be able to access host directories that you explicitly grant access to (--mapdir from the CLI)