FreeBSD jails or Docker/linux containers have very little impact. I bet intercepting some syscalls + running as another user might go a long way without affect

FreeBSD jails or Docker/linux containers have very little impact. I bet intercepting some syscalls + running as another user might go a long way without affecting performance that much.