Containers are zones are great if you're building your own platform that you control.

However I'm not sure building a multi-tenancy hosting environment based on containers or zones is the best idea.

Suppose the tun driver has a bug in it which can cause a kernel panic under some circumstances and that someone running OpenVPN in a container or zone hits this condition. You can now wave bye bye to all the zones running on that host.

https://github.com/joyent/illumos-extra/commit/9412039a18f2f...