I'm not extremely familiar with systems programming or operating systems, so this is probably a stupid question. But I was trying to get a game running in Wine recently that implements an anti-cheat system. After much frustration I learned that it wasn't possible because the anti-cheat system needs to run in kernel mode ("ring 0"?) and Wine runs in user mode ("ring 3"?)
There are plenty of posts about the differences between ring 0 and ring 3, or why Wine runs in one instead of the other. For instance: Why does wine not support kernel mode driver?
However when I thought about it, the problem felt oddly familiar to the one being solved by container solutions like Docker. Would Wine, running inside of Docker, not be able to provide ring 0 access safely? Or can Docker only run user mode programs? Why does an entire CPU need to be emulated when you can just utilize containers to prevent malicious programs from going ham on your machine?