The isolation is the main pin point why I was looking at firecracker.

Thank you for linking gVisor, went through the docs real quick and it looks very promising for my use case.