My start-up has rewritten Kubernetes in Rust because Go is slow and doesn't implement traits in a rustaceous way. Now we have a system about which we still can't reason tractably, but we can guarantee memory safety wherever memory safety can be guaranteed.