Containers vs. Zones vs. Jails vs. VMs
Is it possible to design a process that isn't a self-contained OS instance depending on a lot of
horseshit overlay controls to perform a task in a well
designed way that still allows privilege separation 
from the host OS in a manageable way?Of course not. It's the basis for all this other shite.