Well, thats what cgroups and chroot is for, but then docker is just a fancy wrapper..... As for performance, if its critical then get a real server, if you've

Well, thats what cgroups and chroot is for, but then docker is just a fancy wrapper..... As for performance, if its critical then get a real server, if you've got decent change management (ie ansible, puppet et al with no manual intervention) Then its no effort. (seriously network boot, and vlans are your friend here.)