Trying to understand better the solution. Why isn't it possible to restrict the application via process isolation (nsjail, cgroups, docker...) and wasm is neede

Trying to understand better the solution. Why isn't it possible to restrict the application via process isolation (nsjail, cgroups, docker...) and wasm is needed instead?