2 and 3 are virtually on top of each other. they both use KVM too.

technically 2 exposes a slightly broader attack surface due to the tighter integration model.

you can think of 2 as what would happen if you take 3 and modify it to share resources with the host better. except that they did it from scratch in the memory safe language Go.