+1 for microsandbox. I've been using their golang SDK (https://docs.microsandbox.dev/sdk/go/sandbox) @v0.5.10 to create sandboxes, attach them to agent sessions to execute, and then throw away, all in a raspberry pi 5 k3s cluster (as they have ARM support, if you're into that sort of thing). The microsandbox code is still a bit in flux (since it hasn't reached v1.0 API stability yet), but it's definitely worth checking out as it looks to have a solid foundation.
(edit: ahh sorry, meant to post this to above comment)
^ I second Envoy Gateway! It has support for HTTPRoute like all the others, but also TCPRoute, UDPRoute, TLSRoute, GRPCRoute backed by Envoy and they have worked great for me on EKS clusters I manage for work. The migration from Ingress API to Gateway API hasn’t been bad, as you can have both running side-by-side (just not using the same LB) and the EnvoyPatchPolicy has been great for making advanced changes for things not covered by the manifests
I clicked on this link using a work computer, and for the first time in years I was frightened about what might show up. Not because my work might find out, but at the thought of another disturbing image that you can't unsee being burned into my mind. Thank goodness it really is a Unix-like OS.
I had tried to get into Dune many years ago, but found it hard to keep track of all that was going on. I wish I had pushed through, because I'm now enthralled by the Dune universe. I can say that the movie helped lay a foundation for me that has made the book far more enjoyable - to the point where I'm almost finished with the audiobook after only starting it last week!
(edit: ahh sorry, meant to post this to above comment)