there is some overhead depending of how you define isolation. seccomp has very little impact but it's not 0: https://wiki.tizen.org/Security:Seccomp#Performan

there is some overhead depending of how you define isolation. seccomp has very little impact but it's not 0: https://wiki.tizen.org/Security:Seccomp#Performance_Analysis https://wiki.tizen.org/Security:Seccomp#Performance_Analysis firejail or systemd isolation techniques (using a variety of methods such as mounting a private version of directories or initiating ACL's at application start) are extremely lightweight but not 0. Most processes (regardless of desktop or server) usually live long enough (more than a few seconds anyway) to justify any theoretic impact. Even firejail on an ancient desktop system will not change things so that it's noticeable by a user imo.