Barco: Linux Containers from Scratch in C
> barco enforces a minimal set of restrictions to run untrusted code, which is not recommended for production use, where a more robust solution should be used.Aren't containers never suitable for running untrusted code? You need AppArmor, bwrap, or similar AFAIK.