We use gvisor and cloud hypervisor depending on the use case, which manages these things pretty well by default.