First of all, I know about virtualisation and containers. I'm sure "he wants containers" is what popped in your mind. (Don't deny it!)
However containers are like chroot: if you want to execute bash in it, you need to copy/mirror a bash executable somewhere in the container FS as well as all the required libs. (If I misunderstood something, please correct me).
What I want to know is whether I can start a program like busybox from the current namespace (using the original FS, so no copy needed) and then isolate it (for instance using Linux FS namespace) to let it access one unique directory.
Somehow ssh (sftp actually) seems to be able to do something like this without requiring the sshd executable to be in the chrooted FS. But I still lack skills to understand what's going on by myself.