I don't think we're really comparing hardware virtualization to OS-based virtualization (we at Oxide run HW-based virt inside of OS-based virt so that's a bit o

I don't think we're really comparing hardware virtualization to OS-based virtualization (we at Oxide run HW-based virt inside of OS-based virt so that's a bit of a false dichotomy to begin with), but rather whether or not it's "malpractice" (your term) to run a multitenant workload on illumos zones. And to be clear: we're not talking about Linux here; we're talking about illumos -- for which OS-based virtualization has an entirely different design center. (And indeed, a design center that was -- from the beginning -- designed for securing multitenant workloads.) So your experiences with Linux are of limited relevance here, frankly.