I believe the only remaining hurdle for full isolation is user namespacing, which is slated to be implemented by the next LTS release.