If anyone is doing it from scratch, in a real programming language (which, for better or for worse, seems to currently mean C or Go or futzing with the FFI raw syscalls), one shouldn’t use chroot or the mount syscall. The new mount API is much better.
Cgroups are nice and add some fun features, but they’re just icing on the cake and are also not necessary, even for a very functional and nicely secure container, unless the stuff inside the container needs cgroup delegation.
Using iptables to make a container is IMO pathetic, and I’m hoping to find time at some point to work out something better.
I hope these guys are into doing it well, else runc would be more than adequate for low-level stuff.