Debugging kernel panics on a Wii in an economy seat is a level of focus I can't even imagine. Most people can't read a book on a plane without losing their place every 5 minutes.
500ms fork of a running VM with full memory state is the kind of thing I'd assume wasn't possible until I saw it work. What does failure look like — does the fork just not happen, or can you get partial state?
The QEMU TCG approach makes sense for isolation, but I'm curious about the traffic routing story. Does each container get its own network namespace, or does all traffic still go through Android's network stack? The latter would mean carrier-level DPI still sees everything the container sends — which matters a lot depending on what you're running.