> Security wouldn't be possible without this. You can also think of cgroups/lxc/docker as a direct extension of this. I maybe didn't express myself clearly eno

> Security wouldn't be possible without this. You can also think of cgroups/lxc/docker as a direct extension of this. I maybe didn't express myself clearly enough. The unix user system wasn't designed for the program isolation it is used for today, but for multi-user systems. The security model was to protect the system from users and users from each other. Cgroups are certainly a move into the correct direction, because it's based on the assumption that programs are evil (either by design, or because they get exploited). When you correctly sandbox programs you won't need to run them as a different user anymore.