> Sure and containers give you syscall restrictions and OS protections, but you don’t see people embedding containers inside of other applications. It sounds l

> Sure and containers give you syscall restrictions and OS protections, but you don’t see people embedding containers inside of other applications. It sounds like you're implying that C coders will opt out of the sandboxing provided by the OS, but that's not possible without coding kernel level code. For userland processes, the sandboxing isn't optional, and your process will be sent a SEGV signal if it tries to access memory it's not allowed to access.