#cells

Kernel RFC introduces cells as single hardened container objects

Josef Bacik's 90-patch series seals mounts, network, credentials, and helpers so a container root starts with nothing and host-side escapes are cut off.