[lillecarl]

You also have gVisor, which runs all syscall through some Go history that's supposedly safe enough for Google.

[bjackman]

gVisor uses virtualization