SELinux in a guest [VM or container] should restrict processes in the guest from interfering with other processes and resources in the guest.

IMHO, Nested UIDs like uid1.subuid1.subuid2 would be better for rootless containers than root-writeable /etc/subuids.