I'm looking for the best way to sandbox a JVM process running on CentOS. The process must not be allowed to spawn subprocesses, call ptrace or kill, write access should be limited only to specific temporary directories, and I'd like to restrict IP addresses the process can connect to. On a side note, I know that Java offers its own security manager mechanism, but I'm looking for an OS-level solution.

Does Docker tick all these requirements?

closed as too broad by Michael Homer, Satō Katsura, Mongrel, Kusalananda, thrig Feb 4 '17 at 16:45

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.