At least on Windows, Hyper-V isolated containers are also a supported feature, which should also ensure kernel isolation. I assume Kata containers or any other virtualization backed solution would give you similar guarantees.