I've used linux-vserver.org years ago and lxc, which is in the official kernel, looks promising. This would be relativly efficient and secure (ok, one kernel exploit => all instances)