a few thoughts :)

First of all, way cool project!

Facebook has a [Go package](https://pkg.go.dev/github.com/facebook/time/ntp/chrony) which talks to Chronyd - using that means not having to go the sudo + mounting `/run` route, which should result in a much thinner runtime container - [example](https://github.com/facebook/time/tree/main/ntp/chrony).

Changing the DS to use the host network namespace means that you should be able to talk to the loopback interface on 323 UDP, instead of needing to mount the chrony socket file. This should be much more secure.