Techniques are described herein for isolating runtime environments in a multitenant container DBMS. A CDB may contain a database dictionary that defines a plurality of pluggable databases and a respective database nest for each pluggable database. Each respective database nest of said each pluggable database is associated with different operating system privileges. When database sessions are established on a container DBMS, each database session is given access to a pluggable database by attaching the respective database nest of the pluggable database to each database session.