Apple's preference for kernel-mediated containment is sandboxing, which is finer-grained and operates on applications as the unit. This is probably better alig

Apple's preference for kernel-mediated containment is sandboxing, which is finer-grained and operates on applications as the unit. This is probably better aligned with their general focus on user-facing devices, although the granularity gets messy imo and overall the guarantees are weaker.