Thanks for the article. You may also want to look into Sysbox; it's a new runc alternative that enables deployment of VM-like containers and always uses the Linux user namespace for extra isolation. It bridges the gap between Docker and LXD.