Comment by aktau

My view is this isn't sufficent. They're pretty good at breaking out of stuff. A VM would be the minimal isolation boundary for me.