chroot is fine, though often I will also want resource limits (usually via cgroups) and an IP address (usually via network namespaces.) Often I don't even need

chroot is fine, though often I will also want resource limits (usually via cgroups) and an IP address (usually via network namespaces.) Often I don't even need chroot, just resource limits and an IP address - and the latter probably wouldn't be necessary with a distribution/proxy switch or if if DNS returned IP:port (which arguably it could.)