Well, they hardly build on a "host" anymore. Lots of them build in a docker image, and on build2, the Debian8 is a lxc container.
Our goal is to move more builds to docker, and/or to create the build environment (whether lxc or docker or VM or chroot) automatically. For most builds that's easy, but for manuals, doxygen, coverity and some others it requires special privileges. One way to solve this is to build the special jobs only on very specific build slaves and use the regular (auto-generated) build slaves only for gerrit and non-gerrit buildjobs.