SELinux on a host should restrict KVM (and X/Wayland, and the sound server,). SELinux in a guest [VM or container] should restrict processes in the guest from

SELinux on a host should restrict KVM (and X/Wayland, and the sound server,). SELinux in a guest [VM or container] should restrict processes in the guest from interfering with other processes and resources in the guest. IMHO, Nested UIDs like uid1.subuid1.subuid2 would be better for rootless containers than root-writeable /etc/subuids.