100% agreement. With a kernel design like SeL4 there is no need for crazy sandboxing environments. It prevents you from accessing external resources by default.

100% agreement. With a kernel design like SeL4 there is no need for crazy sandboxing environments. It prevents you from accessing external resources by default. And it is probably as close as we can feasibly get to an operating system that is impossible to maliciously root.