A single binary accomplishes most of those things just fine. Only thing it doesn't get you is isolation, but you can isolate things if you want even then (for example, FreeBSD jails are dead easy to set up).
ok, so you're just using a container with a different name? You can put the single binary in a container and call it a jail if it makes you feel better.