The point is that you only run a single application in the VM anyway. And if you do that, you should make your VM as slick as possible, because anything in ther

The point is that you only run a single application in the VM anyway. And if you do that, you should make your VM as slick as possible, because anything in there that doesn't serve your application is just increasing the attack surface and the probability of errors through side effects. That's what is already done today, and unikernels are just the natural progression towards that goal. So you essentially don't separate your applications via users within your OS, but via VMs in your hypervisor. Not sure if this turns out to be a good idea or not, but it's an interesting approach that shouldn't be put down easily.