I've been using nsjail, which i guess employs several of these techniques.