This. Containers are not ready for production, except for fault-tolerant/distributed payloads. You can't even live migrate them to another host, and CRIU is nowhere near production ready (assuming it ever will be).
Everything else? VMs it is. The overhead is so low nowadays that it's totally irrelevant for the vast majority of use cases.