Essentially shipping an entire OS with every app looks horribly inefficient to me. Especially if the only thing you need is sandboxing. Containers would be a m

Essentially shipping an entire OS with every app looks horribly inefficient to me. Especially if the only thing you need is sandboxing. Containers would be a more appropriate solution, and even containers would be somewhat overkill. Simply using UNIX-style permissions and an application-specific UID could do. I think it is how it is done in Android.