I haven't set that up yet, though I've watched the recemt developments with interest. Another option would be to launch everything (or just Firefox) in cgroups.