I'd be extremely interested to see if this brings greater security to the "container" model. Something resembling BSD jails is sorely lacking in the Linux world.