You can do resource control with cgroups. With systemd based distros you can use "systemd-run" and pass various flags that define the exact limits. Non systemd

You can do resource control with cgroups. With systemd based distros you can use "systemd-run" and pass various flags that define the exact limits. Non systemd distros can use libcgroup or use the sysfs cgroup interface directly. The IP address situation can be handled with the "unshare" and "ip" commands. Unshare allows putting a process in a new namespace and ip allows configuring the interfaces and moving them between namespaces. Both of these solutions do not require any container runtime which is a big advantage efficiency wise! I am not saying that using docker for these purposes is bad though, I just wanted to mention some lightweight alternatives in case anyone was interested.