Adding to replies below I think this is a pretty good articulation of the problem from someone involved with the Bevy project
Pangolin also potentially relevant
Maybe crazy, but I've been running flatcar lately. Automatic OS updates are nice and I pretty much exclusively use most of my machines to run containers.