If you could do this, it would be implemented by using LXC. I used to use an MAI OS that was based on Charles River Unix which used something like this. Instead

If you could do this, it would be implemented by using LXC. I used to use an MAI OS that was based on Charles River Unix which used something like this. Instead of just executing /bin/sh on login, they started a chroot jail and ran /bin/sh inside that. To the user it did look a lot like a private machine. Only admin user accounts could see the whole system. It would be trivial to do this with LXC too.