Disagree. I can create a Linux container (lxc) using virt-sandbox in fedora to bring up a container to run a single command with very ver little effort. It is roughly equal or less work to build a chroot
With very new Linux kernels that have almost all of the user namespace patches merged, there is very little difference. I am curious the technical and not assumed differences however. Note that I donated to the FBSD foundation not because I ever use FBSD, but because in the open source ecosystem, diversity is important. Also, I'm a huge fan of pcc and clang/llvm
Thanks for pointing out virt-sandbox. I wasn't aware of it until now; it looks pretty interesting. Unfortunately the apps I would most like to sandbox, like pdf readers, don't seem likely to work with this approach, since it precludes interaction with X windows.
virt-sandbox does not seem to be available on my Linux distribution (SuSE), so, at least for me, it trivially can't replace jails :) On a more serious note, though, jails seem more appropriate for sandboxing daemon processes than for running one-off commands. I don't think virt-sandbox was designed for this role. In that sense, SELinux is more of a replacement for jails than virt-sandbox.
FYI: virt sandbox created containers are automatically locked down via SELinux[1] so you get the best of both worlds. I do not believe FBSD has a similar information assurance feature akin to SELinux.
