It is a layer of abstraction that helps the application piece but I wouldn't say it solves the real problem being mentioned. That problem is closer to top level

It is a layer of abstraction that helps the application piece but I wouldn't say it solves the real problem being mentioned. That problem is closer to top level uid management. When you are working with 50k systems and have to deal with things like "because there was a slight deviation of install order tomcat is uid 105 on one system and 106 on another set of systems, some tarballs are screwed and need a second perm pass otherwise they'll come up as owned by a different user." And while there are ways to improve this with LDAP and things on Linux covered by nsswitch and so on, they just aren't very nice. And because so much is driven by uid internally finding that one system out of 100 where a constraint is violated is needlessly troublesome, compare this to Windows and AD where at any moment there is always a clear source of truth. Cgroups fixed that in the local space but just having a clean logical mapping that is consistent across all implementations where things are wholly separate by default and there is no bleeding in of the parent OS like a VM does