Firecracker microVMs are safest. That's what I added to my repo; see above.