Or bwrap on linux, which is probably good-enough for most services' isolation needs.