> a number of daemons acting as servers for various network protocols.
Stupid question:  if we'd bring back the original feature that processes could attached to different VNET/VIMAGE stacks would that solve some more of your problems without making the list of problems (a lot [thinking of ifp management]) longer and be a way cleaner solution?
It's something that's been in the back of some of our heads and probably help a lot more people.  We'd need to be careful to be able to support both modes (jail with the "security" view) and the other mode with the multi-tenancy-single-daemon in mind (think of routers as well for example).