You can also use more secure containarization technologies than native docker, like gVisor, to achieve both lightness and isolation.