[veverkap]

That's super interesting - have you written up anything on this? I'd love to read it.

[sureglymop]

No, but I can give a small introduction. I installed krun from the arch package repositories: https://man.archlinux.org/man/extra/krun/krun.1.en

Then one can just pass `--runtime krun` to most podman subcommands. Alternatively, set the runtime key in the config file to make it the default.

Podman itself has "hardening" techniques, e.g. turning off the network or volumes that can be combined with this.