I'm working on Isola (https://github.com/isola-run/isola), a passion project of mine. It allows you to easily create and control sandboxes for executing untrusted code on any Kubernetes cluster (one helm install). To support some features I wanted (like on demand snapshotting of specific containers' filesystem in a sandbox pod or limiting egress rate from the sandbox I am working on now) I contributed some changes to gVisor. Happy to chat about the design and implementation of such a project if anyone interested!