For whatever it's worth, the Crossbow technology remains at the core of our Triton container stack[1] -- and we have extended it significantly by adding VXLAN and virtual layer 2 networking.[2][3] One of the comments we have heard from many early Triton adopters is that they enjoy having IP addresses, networking stacks and bare-metal performance. ;)
[1] https://www.joyent.com/blog/triton-docker-and-the-best-of-al...
[2] http://fingolfin.org/illumos/talks/sdn.pdf
[3] https://www.youtube.com/watch?v=mLvi3nPNqiQ&list=PLH8r-Scm3-...
"the least amount of encapsulation possible" doesn't sound like much of a solution if what you are looking for is networking with strong encapsulation.
>strong encapsulation
What does that term even mean? Are you talking about encryption? If not, there is no 'strength' to encapsulation. Something is either encapsulated efficiently or it's not.
A lot of the problems with regards to containment have already been solved in different systems. I believe solaris or opensolaris had Crossbow [1]. Any system that aims to provide connectivity needs to do the least amount of encapsulation possible and probably be a kernel module.
1. http://en.m.wikipedia.org/wiki/OpenSolaris_Network_Virtualiz...