I retract the statement that I don't see the advantage. See https://twitter.com/rauchg/status/991850924057350144 https://twitter.com/rauchg/status/991850924057

I retract the statement that I don't see the advantage. See https://twitter.com/rauchg/status/991850924057350144 https://twitter.com/rauchg/status/991850924057350144 for why. Basically run `mount` in a gvisor container and run `mount` in a runc container and see the major differences there. Just one example, but as you can see, linux mount namespaces tend to leak lots of mount information. some of it could be cleaned up with additional unmounts after setting up the new root for the container, but knowing what to unmount is not so simple (plus it's just janky AF).