Binary compatibility is the key part. You can ignore a lot of what cgroups and namespaces give you and containers will still "work" (but without the insecure sa

Binary compatibility is the key part. You can ignore a lot of what cgroups and namespaces give you and containers will still "work" (but without the insecure sandbox). Without the binary, you're out of luck.