I’ve had really good results with LXC/LXD. Depending on the privileges of the container the only area of overhead that sometimes concerns me is filesystem IO, but ive been able to work around it.