> I have hope for things like cgroups/jails and MAC/SELinux over virtualization.

The attack surface of a virtualization layer is much smaller than the attack surface of an operating system kernel.