[superb_dev]

Why do they disable io_uring?

[arianvanp]

Sandboxing like gvisor is based on syscalls and iouring makes your code syscallless

[alpb]

Security reasons. https://news.ycombinator.com/item?id=44632240 There are also other edge cases around cgroups accounting that renders some isolation/throttling mechanisms not fully effective.