OK, I see that there is a lot of stuff like chroot and UIDs in SysProcAttr [1].  I think they have added a bunch since I last tried this.<p>But the point still stands... you get a subset of the OS API.  Everything has to be &quot;canned&quot; into that struct and you can&#x27;t execute arbitrary code between fork and exec.<p>Especially with containers, this is a never-ending target...  They apparently have user namespaces, but what about network namespaces or IPC namespaces?<p>[1] <a href="https:&#x2F;&#x2F;golang.org&#x2F;src&#x2F;syscall&#x2F;exec_linux.go" rel="nofollow">https:&#x2F;&#x2F;golang.org&#x2F;src&#x2F;syscall&#x2F;exec_linux.go</a><p>Now, it might be good enough for your application, and it probably IS good enough for everything except a full-fledged production quality init system.  For that case I would be worried about running into limitations.