Good reason as to why even in vms, services should be containerized such as with nspawn, ideally distroless if sanely doable for the service. Not that containe

Good reason as to why even in vms, services should be containerized such as with nspawn, ideally distroless if sanely doable for the service. Not that containerization should be your only protection either, but generally I prefer random users not to have opportunity to just create and run arbitrary executables in default namespace.