Notes on process isolation, jailing (à la Docker, podman), etc.