This is the same concept as CoreOS, which now lives on as Flatcar, though with harder isolation guarantees because VMs.

I love the idea. Extremely minimal attack surface.

At the moment, I'm working on building a virtual version of the NUC that I purchased that will also run Flatcar so that I can test the configuration of my Docker Compose services.