are you concerned about / doing anything for isolation between containers?

I haven't seen a great (lightweight) implementation yet where you can get true container isolation on the same host.

thanks for the write up!