I put each docker container in a LXC container which effectively uses namespaces, cgroups etc to isolate them.