On the latter point, you can actually have the two in one kernel paradigm - use coreboot, run a kernel payload, and use containers. The container kernel hooks are essentially the userspace abstractions without the kernel redundancy.