I think a better but os specific alternative would be to simply have an elf section in a binary per 'container' technology (mounts, unshare, seccomp, etc) that

I think a better but os specific alternative would be to simply have an elf section in a binary per 'container' technology (mounts, unshare, seccomp, etc) that is simply a called at the earliest .ctor. State would be per binary and could potentially be per application as well in say /state/$prog/$app. The upsides of this is simplicity, permanent 'containerization', better handling of state, automatic updates if all this is handled with a package manager and finally the potential to have more locked down containers via analyzing the dep chain.