runas can do that, yes. But it won’t make you a virtual file system, or give you a nat firewall.

One use case for this is the backblaze backup utility. It’s kinda stupid in that it has an all-or-nothing approach to backups.

Putting it in a container restricts it in a much easier and reliable way than running it with a special user account.