Do you have any good resources on where to get started going about setting up failure boundaries/jails/zones/containers like this properly? I think it's surpri

Do you have any good resources on where to get started going about setting up failure boundaries/jails/zones/containers like this properly? I think it's surprisingly easy to get yourself in the situation where this is a concern for you[0] but you don't know how to solve it. [0] Just run "adduser" and have SSH running, or just create an upstart job, or write a custom daemon that accepts and executes jobs from not-quite-trustworthy-undergrads, or...