And jailer from firecracker and systemd itself which has some similar capabilities