> can be every bit as locked down

I've never seen the security stuff from ChromeOS be ported to live outside of ChromeOS. When I looked at it (trying to build the inside-container agents for acustom container image), the error messages for setting it up incorrectly were.. let's charitably say hard to understand. I doubt anyone outside of ChromeOS developers understands it, really.

It's pretty intricate, e.g. giving Wayland access to virtual machines in a safe way.