> [...] services run isolated as their own users [...] provides for a clear and simple mental model [...] How is that a clear and simple model? Are email or pr

> [...] services run isolated as their own users [...] provides for a clear and simple mental model [...] How is that a clear and simple model? Are email or printing users? I think the whole discussion is futile without having a common understanding of what we are talking about. That is: - What is a user? - What is a group? - What is a role? - What is an account? - What is a service? - What is a job? - What is a process? - What is a container? - What is a namespace? Moreover, you cannot say whether an abstraction is good or bad without knowing what our goals, use cases or target users are.