A nice and simple approach to sandbox a command. Of course with the system integration it's a bit porous bit it might be a good base for quite a few uses.

Podman is really a nice option for deploying containers nowadays.

I didn't know about this project. This sounds interesting, smart use of mkosi to make an Incus tailored system.

A bit of a rant, but since it looks like people are still trying to consider all those technologies are equivalent... I think it's good to have an explanation on what makes containers different.