Updates in container isolation [LWN.net]