OpenSolaris does a lot of nifty things in this area. Closest to this is their Image Packaging System: http://hub.opensolaris.org/bin/view/Project+pkg/WebHome ht

OpenSolaris does a lot of nifty things in this area. Closest to this is their Image Packaging System: http://hub.opensolaris.org/bin/view/Project+pkg/WebHome http://hub.opensolaris.org/bin/view/Project+pkg/WebHome Check out the links to Zones (sandboxes) and ZFS (filesystem with cloning/snapshots) at the top if you aren't familiar with them too. While most of the heavy lifting for something like this would happen at the operating system level, you also want to rewrite/fix up many apps to be aware of what's going on. One of the big lessons from BaseShield was that these abstractions are very leaky. Things get confusing to users fast when all apps don't necessarily see the same view of the filesystem. If you want to see this sandboxing/contained apps thing done right, look at the iPhone.