VNET jails are great, especially now that they're stable, but I'd strongly recommend using a higher level tool. I've settled on iocage, but there are a few other tools out there that seem to have gained traction. Nobody sets up cgroups by hand, right?