If Apple would just ship bind mounts and FS/pid namespaces... or even just un-break chroot...