Comment by spacenick88

Well at the very least running in a container gives you filesystem and network and PID space isolation, optionally also user namespace isolation.