Well, thats what cgroups and chroot is for, but then docker is just a fancy wrapper.....

As for performance, if its critical then get a real server, if you've got decent change management (ie ansible, puppet et al with no manual intervention) Then its no effort.

(seriously network boot, and vlans are your friend here.)