seems like docker is a good start - not clear how well that already isolates system/network/etc