Being able to ensure that your important job gets a certain fraction of the CPU, memory or I/O resources regardless of what other jobs on the same machine are d

Being able to ensure that your important job gets a certain fraction of the CPU, memory or I/O resources regardless of what other jobs on the same machine are doing is very much an instance of 'resource isolation' - in terms of usage, rather than access/naming which is the kind of isolation that namespaces provide. CGroups can theoretically provide resource access isolation too, e.g. the device security cgroup subsystem, but it's not really the ideal model for it. FWIW, Borg (at least as of a few years ago - it's possible that it's changed now) hardly uses any resource access isolation - apart from a bit of bind-mount trickery to provide filesystem isolation, it's primarily concerned with resource usage isolation, and jobs are very aware that they're running on the same kernel with potentially many other jobs.