Nice to see this happen! In a similar vein, in Guix we've been discussing ways to run any installed program in its own namespaces, with only the appropriate resources mapped into them: https://lists.gnu.org/archive/html/help-guix/2018-01/msg0005... .

User namespaces slowly but surely help retrofit the "principle of least privilege" to GNU/Linux, and that is good.