[jacques_chester]

Most operators lock down to the runtime pretty tightly, leaving very few capabilities enabled.

If that's not enough, it's easy enough to ensure that a Pod is scheduled to run by itself in an otherwise unoccupied VM.

If that's not enough, the IaaS providers can be paid extra to ensure yours is the only VM on the physical machine.

You can have the same expensive guarantees, if you need them, but with a uniform control plane for all workloads. That's pretty attractive.