> Currently, io_uring system calls are included in Firecracker’s seccomp filter. Because it redefines how system calls are executed, io_uring offers a seccomp bypass for the supported system calls. This is because seccomp filtering occurs on system call entry after a thread context switch, but system calls executed via io_uring do not go through the normal system call entry. Therefore, Firecracker’s seccomp policy should be treated as its union with all system calls supported by io_uring.

...

> Because of the nature of system call filtering via seccomp, io_uring still presents a major security disruption in sandboxing.

This is pretty interesting as io_uring has been seen a lot of press as the hot new thing.