You most likely don't want to set up linux namespaces, cgroups and almost everything else from scratch for every new container you want to develop. The Device that does it in your case is called the "container runtime" - the minimal, even the bottom level utility of each container environment. https://bibisoutherncontainers.com/shop-2/