Comment by codethief

Syd[0] uses landlock (among many other mechanisms) to containerize applications and provides an OCI-compatible interface.

[0]: https://gitlab.exherbo.org/sydbox/sydbox