Thanks a lot for taking the time to explain.
I did notice CTF on the description so I imagine "escaping" it is "harder" than with containers. I recently participated to SplinterCon which included a "block-a-thon" (cf day 2 of https://splintercon.net/brussels/ ) to try to escape a limited environment, approximately simulating the limited Internet access of some political regime. It might be interesting in that context too.
Could also be interesting then to distinguish which defaults are changed compared to Docker ones or examples for which nsjail is currently preferred.
I'd clarify that the shear customizability of Linux is optional.
Take a SteamDeck with SteamOS versus a RPi with e.g Debian.
If you "just" play with the SteamDeck and you don't tinker, well, it "just works". In most, even though not all, normal situations, e.g plugging a screen, pairing a BT headphone, mouse, keyboard, etc it is solid. It has no problem even while using a compatibility layer like Proton for games themselves made for Windows. It even enable some tinkering thanks to its immutable OS and let the player switch to desktop mode. Not everything works but my personal experience since it's been out has been pretty much flawless.
Now, take a RPi, with just as stable hardware, with Debian, even stable, and put on it some IoT device, make some weird modifications for it, try a bunch of stuff, remove package, tinker more, chances are it will still work. Tinker more, make stranger modifications to the point it becomes unstable. Is it Linux itself? I'd argue it's not. I'd argue that instead because we CAN tinker we sometimes do then forget that it's not the same context as something expected to run without hiccup because it's been limited to basically the same verified usage.
So... IMHO Linux is even better than it is, we just shouldn't confuse weird (and important) tinkering with how it can be actually used day to day.