This new version of Ubuntu Linux is already looking good. One new security feature, however, hasn't gotten much attention: Restricted unprivileged user namespaces, It should.

A programmable sandboxing tool, Styrolite locks down Linux kernel namespaces to provide lightweight sandboxes for container-based workloads.