> I currently use isolate (https://github.com/ioi/isolate https://github.com/ioi/isolate) which is just a wrapper around cgroups/namespaces, and it's been a lo

> I currently use isolate (https://github.com/ioi/isolate https://github.com/ioi/isolate) which is just a wrapper around cgroups/namespaces, and it's been a lot faster. Yes. This is the fastest you can get. If you want safer, add pr_set_seccomp _in addition_ to it. but that would be a custom solution.