No programmable network stack though, so can't pass fake credentials to things inside vm and exchange them on the boundary