You could also set gvisor as the default docker runtime. I would do this except all my production belong to docker proper runtime.

Maybe I should redo my node pools on GKE now that using gvisor is a checkbox or flag

Thanks. Would gvisor be stable enough to deploy into production?

That looks very good, thanks