Hasn't Kata containers solved this probl: https://github.com/kata-containers/kata-containers ?
1. If using firecracker then you can't do nested virtualization
2. You still have the "os in an os" problem, which can make it operationally more complex
But Kata is a great project.