I have a solution based on Nix that can be used to generate reproducible container images: https://github.com/nothingnesses/agent-images . It lets you customise which agents, harnesses, or any other packages you want included in the VM and it uses `agent-box` for sandboxing.

This looks like gvisor but is a vm like firecracker right? Any reason you did not want to use firecracker?

(I am testing this now as a backend for my pet project which currently supports firecracker and gvisor. No network.)