Shared read-only core volumes combined with write overlay volumes at the hypervisor level are the way out of this. Containers are pseudo isolation lacking most

Shared read-only core volumes combined with write overlay volumes at the hypervisor level are the way out of this. Containers are pseudo isolation lacking most/all of the isolation, capacity allocation, and rate limiting guarantees that type-1 hypervisors offer. There is no substitute for better technology (like partially paravirtualized VMs, mem deduped) used correctly, similar to Kata Containers.