Shared read-only core volumes combined with write overlay volumes at the hypervisor level are the way out of this.

Containers are pseudo isolation lacking most/all of the isolation, capacity allocation, and rate limiting guarantees that type-1 hypervisors offer.

There is no substitute for better technology (like partially paravirtualized VMs, mem deduped) used correctly, similar to Kata Containers.