A light-weight process isolation tool, making use of Linux namespaces and seccomp-bpf syscall filters - View it on GitHub