you have to be careful how you define "secure" here. you are correct that selinux is a requirement if you are worried at all about x-container interaction. but

you have to be careful how you define "secure" here. you are correct that selinux is a requirement if you are worried at all about x-container interaction. but even with selinux, you are still exposed since you are sharing the kernel and would have to do work for top, ps, and others to not share what is going on across the system.