Five container runtimes: when runc is not the answer

runc, gVisor, Kata, Firecracker, and WASM on one Go service — cold start, memory, and threat-model fit.