I wasn't necessarily referring to containers; I was referring to sandboxing tools like Bubblewrap and Minijail, which isolate many parts of the host system, the

I wasn't necessarily referring to containers; I was referring to sandboxing tools like Bubblewrap and Minijail, which isolate many parts of the host system, the namespace, and filter syscalls. This approach combined with restrictive SELinux policies should be much more widespread. By default, most *nix systems don't really have any security model besides user accounts. When programs run with some more isolation/sandboxing, they won't be able to access the same copies of shared libs loaded by other programs so they'll re-load them. In most benchmarks I've seen, a much greater amount of memory is used by a program loading a single shared library than a statically-linked program, even excluding the overhead of the ld interpreter. I was also referring to the OS package manager, not bleeding-edge programming-lang-specific package managers.