Only one of those doesn't apply actually! > run my processes as uid!=0, shouldn't use selinux You can automatically have your applications all run in username

Only one of those doesn't apply actually! > run my processes as uid!=0, shouldn't use selinux You can automatically have your applications all run in usernamespaces (uid!=0) with containers. You can automatically apply selinux policies to all containers and then layer further contexts.