Arvados

We're not sure if this is doable, or how it would be implemented. But the goal is to be able to record stats for containers and compute nodes inside of Prometheus, and then allow users to view the stats for their own containers, without giving them permission to see other containers, general cluster services, etc.

It should be possible for the user to talk to a Prometheus API endpoint, at least one that's fully-featured enough to view stats. They authenticate with their Arvados API token. The endpoint reports stats related to their containers, and no others.