"... and then I discovered the privacy.firstparty.isolate option (in about:config), which effectively gives every site its own container ..." But with its own

"... and then I discovered the privacy.firstparty.isolate option (in about:config), which effectively gives every site its own container ..." But with its own IP, possibly a non-routable, private IP ? I think not ... and that's too bad because that is what we really need. We need the ability to chroot jail a GUI program just like we jail named or (whatever). A different root, a different IP, and no access (or knowledge) of the rest of the system. If I used facebook, that's the browser I would run it in.