VMs are perfect for that teaching scenario. That said, you're not supposed to be able to load kernel modules from a container. Which is exactly the sort of id

VMs are perfect for that teaching scenario. That said, you're not supposed to be able to load kernel modules from a container. Which is exactly the sort of idea an enterprising rootkit author might think to take advantage of ;-) You might consider asking your students if they can figure out how they might go about getting a kernel module installed from in a container despite it not being allowed - and what advantages does that bring to the rootkit author. If necessary, you can test it using an LXD container in a VM.