Exactly what Google has done with ChromeOS 67. You can run GNU/Linux applications as containers. But extra safe as a container on a separate kernel through a VM using KVM.
Versus they did Android as a container on the same Linux kernel as ChromeOS. But locked to only an Android container.