This sounds great. By the way, does "kernel-level isolation" mean "you have to allocate a chunk of RAM to this"? Or is that CPU-level?

EDIT: Ah, looks like it means "runs its own kernel", not "isolates at the kernel" like Docker does.