Handling HTTP requests can be done entirely via stdin + stdout. But it won't be too useful if you could not even talk to a database.

The VM may (and should) be limited to a small subset of what's available on the host though.

But in order to read from stdin and write to stdout, you must make I/O syscalls.

I mean you don't get to open files, sockets, devices, etc. in the sandboxed program. You get to do just a few minimal things like I/O on stdin/stdout/stderr, use shared memory, maybe allocate memory.

So how do you do I/O on stdin/stdiout/stderr without syscalls?

There's a tiny kernel, and there are syscalls, because after all the executable is -though ELF- a statically linked executable with a statically linked libc, but that mini kernel only handles very few system calls, and does not provide the full generality of Linux. Yes I shouldn't have said "there's no syscalls", just no generic I/O.