Well the technologies behind containers can used independent of containers. For example with mount namespace you can modify filesystem layout, mem cgroups for m

Well the technologies behind containers can used independent of containers. For example with mount namespace you can modify filesystem layout, mem cgroups for memory limits and so on. There are 3 issues of these: 1) Several operation are root only or need user namespaces which has its own problems. 2)almost all of these operations are inherented by processor in similar manner as user of the process effectively making a need for some kind of sudo or polkit style solution. 3) some protocols and storage systems are implemented in userspace and are hard to sandbox making a need for proxy. Examples are Xorg, dbus, DNS, dconf. So proxy and policy management is kinda an issue.