Thanks. So there are two concepts where isolation is mentioned, the --pure and the --container options. But still the documentation is very light on details and

Thanks. So there are two concepts where isolation is mentioned, the --pure and the --container options. But still the documentation is very light on details and doesn't really answer what kind of (if any) security boundary or sandbox is provided by the container feature. How might it compare to eg using nsjail[1] or firecracker [2] or flatpak's sandbox[3]? These could be also good benchmarks for the documentation. [1] https://github.com/google/nsjail https://github.com/google/nsjail [2] https://github.com/firecracker-microvm/firecracker-containerd https://github.com/firecracker-microvm/firecracker-container... [3] https://docs.flatpak.org/en/latest/sandbox-permissions-reference.html https://docs.flatpak.org/en/latest/sandbox-permissions-refer...