[swagasaurus-rex]

Containerization built in to the OS, with strict privacy controls on what containers can access inside of other containers.

All applications run in its own container, unless they are granted granular permissions to do otherwise.

The code and assets for a program belong in its own quarantined section, not spread out over the filesystem or littered around /etc/, /var/

Built in networking for these containers.

[rtkaratekid]

Couldn’t you essentially make a Linux distribution that has these by default?

[zekrioca]

That's exactly how ChromeOS works.