One of the lmctfy developers here. I'll try to start with one-liners and put in some more details later. Linux kernel supports cgroups for resource isolation (cpu, memory, blockio, network, etc) that doesn't require starting Virtual machines. It also provides namespaces to completely isolate application's view of the operating environment (process trees, network, user ids, mounts). LXC combines cg