openshift will give you a small container for free.

So it looks like they've solved it -- with selinux, seccomp and judicious use of capabilities no doubt.