Aren't the syscalls a constant moving target? Didn't even Microsoft fail at keeping up with them in WSL?

Not Linux syscalls, they are a stable interface as far as the Linux kernel is concerned.

Linux is exceptional in that it has stable syscall numbers and guarantees stability. This is largely why statically linked binaries (and containers) "just work" on Linux, meanwhile Windows and Mac OS inevitably break things with an OS update.

Microsoft frequently tweaks syscall numbers, and they make it clear that developers must access functions through e.g. NTDLL. Mac OS at least has public source files used to generate syscall.h, but they do break things, and there was a recent incident where Go programs all broke after a major OS update. Now Go uses libSystem (and dynamic linking)[2].

[1] https://j00ru.vexillium.org/syscalls/nt/64/

[2] https://go.dev/doc/go1.11#runtime

arm64 macOS doesn't even allow statically linked binaries at all.

on the windows side, syscall ABI became stable since Server 2022 to run mismatched container releases

They're not really a moving target (since some distros ship ancient kernels, most components will handle lack of new syscalls gracefully), but the surface is still pretty big. A single ioctl() or write() syscall could do a billion different things and a lot of software depends on small bits of this functionality, meaning you gotta implement 99% of it to get everything working.

They didn't.

FreeBSD and NetBSD do this.