While I'm not excited by the idea of having a kernel-wide concept of "container", I do love the idea of being able to create a new detached filesystem namespace, mount things into that namespace, and openat and fooat in that namespace.