We are going to focus on (1) and (2). The third (3) type of isolation can be explored in extra credit.

For process group isolation we need to create separate "namespaces" for each container. That is, processes in one container will have different PIDs than processes in another container. Said another way, processes in one container should not be able to "see or touch" processes in another container. In terms of xv6 this means that a process in one container cannot kill a process in another container. In addition, processes from two different containers cannot share pipes. 

Processes in a single container have a "virtual" PID space. You can have a process in container 1 with a PID of 1 and a process in container 2 with a PID of 1. This should not be an issue for the kernel.

You will also need to enforce three types of process execution restrictions. You need to enforce a maximum number of simultaneously running process, maximum amount of memory for a container, and fair share scheduling of containers.

In addition to process group isolation, process groups should be scheduled in a fair share manner (https://en.wikipedia.org/wiki/Fair-share_scheduling). This means that each container should receive an equal portion of CPU time, not each process in the system.  Say you have two containers: A and B. Assume container A has 1 process and container B has 2 processes and all the process are running at the same time. The process in container A should receive 50% of the CPU time and the two processes in container B should receive the other 50% of CPU split among them so that process B:1 gets 25% and process B:2 gets 25%. You can imagine other scenarios involving more processes and more containers.

For File System isolation, we want each container to have access to it's own virtual file system on top of the real file system. This can be achieved in part with the chroot() system call (https://en.wikipedia.org/wiki/Chroot) which allows you to change the default root directory for an individual process. In our case we want to perform chroot() for an entire container so that all processes with in a container see the same root directory. You will provide some user level tools (applications) that allow the creation of a container and the ability to populate a subdirectory with specific applications for that container (like a specific shell implementation). When the container is launched only the files in the containers file system will be accessible. You can use a directory as the virtual file system for a container. If you want, you can also put container onto a separate disk or partition.

If any of the resource limits are exceeded you should kill the offending container and all of it's processes.

Finally, resource isolation allows other devices to be shared fairly among containers just like the CPU. For example, the hard disk and the network interfaces should be scheduled in a way that each container gets their fair share. This type of scheduling isolation is important in real container systems, but you will not be required to implement resource isolation for this project. I will make this an extra credit opportunity.