>it can read other process memory and all the files owned by your user Tools like flatpak and bwrap exist. A process in a bwrap sandbox can't read other proces

>it can read other process memory and all the files owned by your user Tools like flatpak and bwrap exist. A process in a bwrap sandbox can't read other processes memory or any files that I didn't bind into the sandbox. If I want to run an X11 GUI app in a sandbox, it can trivially escape. Wayland makes it possible to do this without a trivial escape. Also, processes cannot read other processes memory without being a parent process or something, or having root, and with bwrap they can't even see other processes running on the system at all.