[IshKebab]

Postgres does that for its new Rust support.

https://news.ycombinator.com/item?id=35501065

They do ban unsafe and also the stdlib which probably covers a lot of soundness holes.

Also I suspect the trust level required is somewhere in the middle.

[dathinab]

in most situations custom SQL function are from a trusted source, through potentially run with untrusted inputs in a unprivileged/trusted execution environment.

this would mean they don't necessary rely on it for sandboxing untrusted code purpose

it's more like a convenient way to write a native extension function

through it's still a bit worrisome