Can I keep X11/mesa/vulkan/vc4 assets only in a container (non-privileged) and not in host OS?

) nope, but once I sort out issue of booting Ubuntu Core from M.2 SSD on my Pi, I will come back to my tryout. I’ve bookmarked Physical GPU passthrough to VM seems to be working, but guests output only to Virtio GPU as it is somehow adjacent (though for VM) for that time.