The syscall instruction is the only door from userspace to the kernel: strace shows this boundary, seccomp filters it (every Docker container runs under such a filter), and vDSO exists to avoid crossing it. Writing raw wrappers shows what glibc hides and why syscall overhead shapes the design of io_uring.