After a brief journey through namespaces and cgroups, rlimits seem to be an effective way to enforce most of the assurances I need.
After a brief journey through namespaces and cgroups, rlimits seem to be an effective way to enforce most of the assurances I need.

unprompted/tildefriends,unprompted/tildefriends,unprompted/tildefriends,unprompted/tildefriends,unprompted/tildefriends