alt Hacker NewsBased on the readme in your project, yours does not include 1) a policy engine, 2) application proxies to limit scope of access to external systems/networks, 3) firewall configuration for commonly accessed package repositories, 4) configuration management, 5) credential management.
You do have some scripts that 'diff' package inventory of the one distro you support, but not a full fledged configuration management system to manage package dependencies, file permissions, services, etc. Technically the user can deploy one using your provisioning hook but since it's not built-in it's another component the user will need to bring with them, which is one more reason they can use any other system that does basic sandboxing. I'm sure it's useful for you, but it doesn't do anything all the other solutions don't already do. You basically made Vagrant but without the useful Vagrantfile and OS-agnosticism.
You quietly dropped rollbacks and the lethal trifecta from your list, the two exact things my project is great at. It's got qcow2 delta images and a fully customizable egress firewall backed by standard nftables.
You substituted in application proxies and firewalls for package repositories. Implementing those is what I came to this thread for. Already planning a custom network stack to replace passt. It will have those features soon. Credential management too.
> It doesn't do anything all the other solutions don't already do
That's just false. I built virtdev because I literally didn't find any other tool that implemented KVM virtualization, cheap expendable contextual VMs and configurable egress firewall with minimal, soon to be zero root access requirements. Virtdev also manages daemon life cycle correctly via user mode systemd, which is something I just don't see other projects do.
Vagrantfile and OS agnosticism are not why I built virtdev. Vagrant has no security focus at all, and I explicitly opted out of declarative YAML because GitHub Actions is painful enough.
> since it's not built-in
By this logic, no composable tool has any value. I chose to provide mechanism, not policy. The primitives are there.
> it's another component the user will need to bring with them
Yes, as files committed to a dotfiles repository. A one time configuration.