My favorite quick security tool on Linux is firejail, which uses seccomp-bpf under the hood. So I was quite excited to see in your container paper discussion of that and the interaction of Linux subsystems I do not really grok.
Keep up the good work. Obviously not all for me, but I benefit. :-)