How does it work?

• start with chroot,

• optional "security context" on processes

• isolation between "security contexts"