Hi Alessandro - amazing work on this & thanks for the reply. This is the coolest WASM demo I've seen since the first Emscripten release. Moving WASM execution from a compile-time choice to a runtime choice is pretty amazing. I need to noodle on the implications of the portability benefits.

> The tradeoff is only some performance, there is no security risk. CheerpX used standard WebAssembly/JavaScript/HTML5, there is truly no difference between this and any other Web page you might visit.

I understand that the security model is more like a webpage than a local binary. What I don't understand is:

(1) what is the relative difficulty of escaping a full, local VM vs a local browser sandbox vs microVM container? That is, if you want to run an untrusted x86 binary locally, is CheerpX + browser sandbox really as safe as VirtualBox or firecracker? I suspect there's a speed/security tradeoff happening somewhere.

(2) how complete is the set of operating system APIs available to an x86 running in WASM via CheerpX vs running that same application locally? That is, what local functionality might I sacrifice to use the browser?

(3) what is the nature and magnitude of the performance hit? Obviously you have to load the binary over the network in this demo, but locally-hosted resources should be fine.