You can get some of that with IncusOS (https://linuxcontainers.org/incus-os/introduction/), which includes ZFS, immutability and manages both containers and VMs. I haven't used the OS yet, but have been enjoying Incus + Ubuntu.

Using incus heavily on Omarchy here and love it. I created a script to read yaml configs and create ephemeral incus containers with certain capabilities and certain directories mounted within. It's a wonderful experience for sandboxing Claude Code.