They're working on native first party isolation, but it breaks authentication via Facebook/Google/other OAuth vendors.

It's a tough problem, and I agree the grandma test is a good standard, sometimes it can't be easily done.

Sure. Might be nice to have an adblocker-style filter that says what domains should be considered a single origin, plug that into containers.

Container tabs has that feature built in, you can say that google.com and youtube.com always automatically should open in the same container.

It's still too difficult and cumbersome to use. I might want to have one tab with gmail signed in but another to make anonymous searches on Google, both are on google domains so i have to manually fiddle with the containers again. Then you click a link in an email or search result and you don't really know if this tab should be in the mail-container, in the default container or in the domain-matched container.

I know that feature is there, I was thinking that there could be a maintained list of domain groups you could subscribe to like filterlists. That way you wouldn't have to wait for a Facebook Container addon and a Google Container addon &c.