How does it work?

• start with chroot,

• optional "security context" on processes

• isolation between "security contexts"

• resource limits to prevent systems being overrun