ironically docker never gave you true network isolation because there's no way to make it user friendly. plus the many exploits on the all powerful daemon.

but most professional world use systemd to bootstrap isolated processes nowadays, which is kinda if what you are hinting at. cgroups2 and namespaces are what you want.