"Is there consensus on security bad/best practices when it comes to VMs and containers?" Yes - it's called simplicity. Fewest moving parts possible. Limit at

"Is there consensus on security bad/best practices when it comes to VMs and containers?" Yes - it's called simplicity. Fewest moving parts possible. Limit attack surface to the smallest amount possible. You can pursue this at every layer of the stack and at every layer of abstraction - it should be a primary design philosophy that informs every system you build.