podman

Potential malware will share a kernel with the host. One exploit and we're owned. Virtual machines are the better solution. Infinitely smaller attack surface. If they crack hardware hypervisors, it means the entire industry is in deep shit, not just us.

I went so far as to code up my own development virtual machine orchestration software. Now I'm making a custom Rust network stack for it.