You can also use MAC and avoid container overhead. SELinux is the worst of the bunch because its a PITA to work with, while AppArmor profiles are pretty easy to

You can also use MAC and avoid container overhead. SELinux is the worst of the bunch because its a PITA to work with, while AppArmor profiles are pretty easy to write but its not particularly foolproof, Tomoyo has nobody developing good profiles for it, and we should all be running Grsec Kernels + PaX since its the best of all worlds but again nobody wants to put in the effort to develop all the profiles for all the programs we use, and learning modes are just unacceptable.