If desiring containers are what the OP's assertion is about "Windows, Linux, and MacOS all have this problem because they don't run sandboxes by default. OSes s

If desiring containers are what the OP's assertion is about "Windows, Linux, and MacOS all have this problem because they don't run sandboxes by default. OSes should be redesigned to make it nearly impossible to install a rootkit" Isn't an OS problem, and requires no redesign (well no idea about Windows), it's just a choice of how to run their machine. Perhaps if OP believes that all apps should be containerised, but this doesn't need an OS to be redesigned, it just means a new skin. I could easily see a "Dockbuntu" which, instead of distributing programs like Firefox and spotify, distribute links to docker containers running those programs, where the user can choose which directories to mount into the application's container (and whether they should be readonly, readwrite, etc)