I agree with you that cgroups protect against denial of service attacks, and that the device whitelist provides some additional security (I actually did not kno

I agree with you that cgroups protect against denial of service attacks, and that the device whitelist provides some additional security (I actually did not know about the latter, so thanks! TIL). Thinking about it, if you exclusively use block devices for storage, this is a lot better than I expected. But still, this is nowhere from a "a least-privilege container for each VM" as you suggested. (I'm a heavy libvirt user myself - thank you for your work on it!)