Replace "containers" with "virtual machines" (because really, the containers are secure only until the next kernel exploit, which happens fairly often), and you

Replace "containers" with "virtual machines" (because really, the containers are secure only until the next kernel exploit, which happens fairly often), and you get Qubes OS: https://www.qubes-os.org/doc/architecture/ https://www.qubes-os.org/doc/architecture/ It tries to move everything into containers, including hardware drivers, and if you read their architecture paper you will see their design ends up being nontrivial.