Podman with the new crun[1] container runtime is pretty lightweight. Everything circles back to C.

[1]: https://github.com/containers/crun

UTC

GCP's Cloud Build is also a simple option.

Changing the DNS server on Android is really not ideal and in some networks outgoing DNS requests are blocked or redirected to the local resolver.

I know it's a lot more work but setting up Shadowsocks and Unbound with similar DNS blacklists is a much better solution. This also comes with all the benefits of using a VPN (technically, an obfuscated socks5 proxy using the android VPN interface). If you manage the network, pfSense and pfBlockerNG are also great and easy to set up.

Indeed, Shadowsocks is great but it's just a socks5 proxy under the hood.

With the exception of the QUIC protocol.

* TLS over 443/udp

Calling rkt and runc docker flavors is a bit misleading. Runc is an OCI standard container runtime which docker itself also uses. Although rkt can consume docker images it is an entirely different container runtime with several distinct execution stages. For instance, you can run rkt containers with an LKVM stage1 instead of systemd-nspawn.