Firecracker and katacontainers (and other KVM based "containers") are valuable for multiple tenants that don't trust each other. They are less helpful if you trust what you're running.

In fact, a Fly Firecracker VM is not all that different from a DO droplet. We expose them as containers, but you could run Dokku within a Fly app and have a similar set of stuff under the covers.