I'm curious if you've looked at a fundamentally different solution - namely, mklinux[1]? You not only skip the entire KVM/Firecracker VMM/Kata Shim/Guest Linux/Kata Agent stack which achieves your goal of reducing the attack surface, using mklinux also mitigated entire classes of vulnerabilities such as buffer overflows/out-of-bounds I/O in the virtio stack, speculative execution side-channels, SLAT bugs etc.

[1] https://multikernel.io/technology.html

Thanks! No haven’t heard of this. Do you have any experience deploying untrusted workloads with this tool? care to share some more info ?