@Dendrobatus_Azureus@mastodon.bsd.cafe bwrap is pretty efficient. I can't speak for container runtimes because I don't use them for isolation and sandboxing, more of "We'll ship your system to prod and call it a day" sort of setup.