> My own dream system would be one where every "package" for my operating system is a filesystem image with `/bin`, `/lib`, `/etc`, and possibly `/var`. Take a

> My own dream system would be one where every "package" for my operating system is a filesystem image with `/bin`, `/lib`, `/etc`, and possibly `/var`. Take a look at NixOS and the Nix package manager. It works along these lines [0]. > then, `init` would spin up each service in complete isolation by spinning up `chroot`s Systemd employs container features, some automatically like cgroups and some via configuration. There was an article on HN just the other day about some of its new sandbox features [1]. Parameters such as PrivateNetwork=, ProtectSystem=strict, PrivateTmp=yes, SystemCallFilter= provide chroot-like capabilities in a number of different namespace dimensions. It has support for chroot as well through the RootDirectory= parameter. See [2] for a good overview of these featuers and [3] for the reference. Hopefully as these features mature and gain adoption, system software will operate more like what you're describing over time. [0] https://nixos.org/ https://nixos.org/ [1] https://news.ycombinator.com/item?id=12874731 https://news.ycombinator.com/item?id=12874731 [2] http://0pointer.de/blog/projects/security.html http://0pointer.de/blog/projects/security.html [3] https://www.freedesktop.org/software/systemd/man/systemd.exec.html https://www.freedesktop.org/software/systemd/man/systemd.exe...