or treat vm's as containers and just spawn a single process in a firecracker vm. More secure than containers will ever be and just as easy as another vm. Could be managed by kubernetes if you like or need to manage many of these.