Damn, this is going to eat the world. Docker but with full host isolation making it suitable for untrusted workloads, hot damn. This could for real make fully managed multi-tenant completely serverless k8s possible once it gets to the point where it can be used as a containerd and CRI implementation.
Been doing that by running kubernetes inside SmartOS zones via bhyve VMs on multi-tenant systems. Works pretty well, although they are slightly more resource hungry VMs than the ones in this article.
