It's a shame that multi-ring security never really made a comeback. The ability to let any ring (such as a user ring) handle the library and system calls of an

It's a shame that multi-ring security never really made a comeback. The ability to let any ring (such as a user ring) handle the library and system calls of an outer ring (such as a container ring) seems like it would be convenient. Alternately, some microkernels have a more peer-to-peer setup which could work as well.