openscap has been able to do this either on an installed system or on a chroot for years. But "containers", so it's all new and exciting, and definitely nothing like chroot/jails.