Isolate
~~~~~~~
-Make the list of bind-mounts configurable (some of them even read-only)
-Virtual /dev
Installation
Test: ptrace self
Test: SIGSTOP
Test: ping-pong timing attacks
Test: big static memory
-Doc: avoid AS randomization
-Doc: avoid cpufreq
+Examine the use of taskstats for measuring memory
+Doc: mount -t cgroup none -o cpuset,cpuacct,memory /sys/fs/cgroup