> I'm not sure what they mean here. Firecracker doesn't restrict the set of system calls guests can use. In my mind, that's one of the biggest advantages of Firecracker's approach - there's no hard tradeoff to be made between isolation strength and guest software compatibility.

gVisor is also not artificially restricting this set (it is limited by what's implemented, but that's not a hard trade-off); the sentence means that both Firecracker and gVisor restrict the host surface available to the effective "supervisor", either the VMM or the Sentry.