I was clarifying that there are CPU cgroups, network cgroups etc and the proposal touched only memory cgroups.

The people deploying it are free to restrict the cgroup to one process before requesting MAP_UNINITIALIZED if there is a concern around security. At that point the memory cgroup becomes a way to get around the page tracking restriction.

But I get why aesthetically this idea sounds icky to a lot of people.