Is there a way to restrict container access for user in Docker?
Why not creating a separate Docker container for each service?
So in other words, You create one container for each friend, and on each container you create a user which is a member in sudo (so your friend will be the root of his own container). Then install openssh-server, and give each of your friends the SSH access data (his username and password) to his container. This way they can do what ever they want, without affecting each other.
Of course do not forget to forward the SSH connection (and any other connections of the services you want) from the host to the container.
Sadly as standing there
Why doesn't Docker support multi-tenancy?
docker doesn't support multi-tenancy so you cannot isolate users from each other.
Edit: one of the possible solutions is to create SSH server in every container and then let your users to connect directly via SSH to container instead of using host machine.