This is definitely true, and to be honest, it's something of a mystery to me why the OpenVZ work has been essentially a second-class citizen for that decade. I

This is definitely true, and to be honest, it's something of a mystery to me why the OpenVZ work has been essentially a second-class citizen for that decade. If Linux had taken path lit by OpenVZ (which is to say, if Linux had taken back the OpenVZ changes), the security gap between Linux and FreeBSD/SmartOS/illumos might have been closed much more quickly -- but as it stands (with the OpenVZ work essentially discarded in favor of the much more immature namespaces), Linux isn't on a trajectory to offer multi-tenant security via containers in the foreseeable future...