Trying to understand better the solution. Why isn't it possible to restrict the application via process isolation (nsjail, cgroups, docker...) and wasm is needed instead?