"Especially sudo with all the magic that goes behind executing a process as another user."

Your last sentence kills your standpoint totally.

Please check out the mentioned "toft". It's lxc inside vagrant and designed to test complex infrastructure code from the outside in. Nothing web related.