BSDs have had jails for ages, which (unlike Docker) have been designed as a security isolation mechanism from the get go.

https://www.freebsd.org/doc/handbook/jails.html