I made Locki: https://github.com/JanPokorny/locki

Internally uses a single VM + Incus containers, supports docker/Kubernetes in each sandbox, has integrated worktree management.