https://cloud.google.com/kubernetes-engine/docs/concepts/sandbox-pods (powered by https://gvisor.dev/) are related to the kube container isolation discussion we mentioned in the sync the other day

We could also use https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ for custom registries, but we would need to scope access to registry secrets to the correct service user the scheduler is using to launch pods ofc

adding to this thread, we can take the aws route and use firecracker