If you do want a stronger security boundary, you can do that without using cgroups and other kinds of namespaces (aside from chroot) pretty easily using somethi

If you do want a stronger security boundary, you can do that without using cgroups and other kinds of namespaces (aside from chroot) pretty easily using something like `firejail` -- that's what I do for this demo [0] (all the software is in /opt/appfs, if you want to try stuff out -- you can browse it here [1]) [0] https://rkeene.dev/js-repl/?arg=bash https://rkeene.dev/js-repl/?arg=bash [1] https://browser.appfs.net/ https://browser.appfs.net/