Place SSH users in Docker jails, or just use it as a replacement for docker-bash / dockersh.