@matrix Neither do most people who use it. It's mostly duct tape. Grab a namespace, some cgroups, some ulimits, put it all in a cgroup and duct tape it all together with some shitty iptables rules.