Well at the very least running in a container gives you filesystem and network and PID space isolation, optionally also user namespace isolation.