[nijave]

>you still can't run multitenant workloads from arbitrary untrusted tenants on shared-kernel isolation

All those bargain basement OpenVZ "VPS" providers beg to differ :)

There's also gVisor