Proof-of-concept container system that (mostly) restricts host access to the container's underlying storage