This is a surprising development. I wonder how much of it was opportunistic, since Talos 1.14 added sandbox isolation based on Linux namespaces (?). Perhaps the reasoning was "let's just go one step further and support full containers/VMs instead of inventing our own sandbox mechanism".