> It should not require root at all (no setuid either). The only thing that really needs setuid are network namespaces to setup the bridges. Userspace workarou

> It should not require root at all (no setuid either). The only thing that really needs setuid are network namespaces to setup the bridges. Userspace workarounds are clunky and slow. If you can do without network isolation then this would be possible. > The containers should be nest-able to arbitrary depth without performance loss (at least to say, hundreds of nestings deep.) Multiple levels of nesting are ppossible if you disable seccomp. I don't know if it scales to hundreds though. Overlayfs has hard limits and btrfs snapeshots don't scale infinitely either. > Also, it wouldn't really be a product at all but just a built-in tool on Linux systems. Well, there's systemd-nspawn and machinectl