Isolating Containers with ZFS and Linux Namespaces

If someone is looking for an out of box solution: This works fine with incus (former LXD). https://linuxcontainers.org/incus/

Some things are not namespaced yet in the kernel - so running Kubernetes in a namespace is not possible due to some network module requirements that are missing. NFS is another issue. SELinux might also be impossible.

But it's perfectly fine for most everyday needs.

What's missing is something like blkio but there is work in the openzfs pull requests.