If you run a unikernel under an OS you can do very aggressive sandboxing (eg seccomp type 2 under Linux), as it does not really use any of the OS facilities, eg

If you run a unikernel under an OS you can do very aggressive sandboxing (eg seccomp type 2 under Linux), as it does not really use any of the OS facilities, eg just read and write a raw socket file descriptor. So you end up with a pretty decent userspace security model, and small statically linked elf files as your container format. I am currently working on this, should be usefully usable soon.