As well as this, GrapheneOS also supports automatic rebooting for if your phone is taken by force. As once you’ve logged in from a cold boot, your data is in a vulnerable state where cops can access it without needing your passcode. With GOS, you can specify an amount of time for the phone to wait since the most recent login, and once that time has passed, it will automatically reboot the phone, placing your data back into the cold and secure state, so that the cops must then acquire your passcode from you, at which point you’d be able to give them the duress pin and ensure that the data is removed safely.

Apps that depend on talking to specific hardware ( including the GPU) do not always work in a VM.

Unless you go about setting up IOMMU groups with QEMU/KVM… (And have a second GPU to hand over to the VM.)

KVM, QEMU, Looking Glass

Or the new Ubuntu Cinnamon