Yeah this basically. I differentiate between "containers I wrote" (where I packaged the app/wrote the OCI "Dockerfile" / container file) and "containers from ot

Yeah this basically. I differentiate between "containers I wrote" (where I packaged the app/wrote the OCI "Dockerfile" / container file) and "containers from other people": all those I wrote (for our own use) go into one VM, while all the other containers go into another VM. Then I've got a third VM for containers for the AI agents. This way I don't pay tens of VMs "tax" but basically only three (plus one or two VMs I use for testing enhancements to my VMs provisioning / optimization / securing setup, when I work on that). I don't use LXC (I could) but regular containers, inside VMs. I'll look into the stripped down "micro" VMs but then I don't spend my days launching VMs/shutting them down so it's not a big deal.