In theory LXC could do this. It needs to be tested more and clearly has security issues right now.