Hmm... "resource management benefits you get from sharing a kernel" costs the security risks you incur from not having kernel-level isolation.

These days I'm looking at microvms (esp. smolvm from smolmachines.com) by default, for anything where I'd previously have reached for docker (via colima or more recently orbstack).